CVE-2025-59287
קריטית 9.8 מנוצלת בשטח (KEV)
ניצול פעיל מאומת — קטלוג CISA KEV
- שם
- Microsoft Windows Server Update Service (WSUS) Deserialization of Untrusted Data Vulnerability
- נוסף לקטלוג
- יעד טיפול (פדרלי)
- פעולה נדרשת
- Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
תיאור (מקור, אנגלית)
Deserialization of untrusted data in Windows Server Update Service allows an unauthorized attacker to execute code over a network.
מדדים
- CVSS 3.1
-
9.8 (CRITICAL)
מקור הציון: CNA
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - EPSS — סבירות ניצול
- 100% (אחוזון 100) נכון ל-26/7/2026
- CWE
- CWE-502
מוצרים מושפעים
microsoft: windows server 2012; microsoft: windows server 2016; microsoft: windows server 2019; microsoft: windows server 2022; microsoft: windows server 2022 23h2; microsoft: windows server 2025
קישורים
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-59287 Vendor Advisory
- https://hawktrace.com/blog/CVE-2025-59287 ExploitThird Party Advisory
- https://www.bleepingcomputer.com/news/security/cisa-orders-feds-to-patch-windo… Press/Media Coverage
- https://www.vicarius.io/vsociety/posts/cve-2025-59287-detection-script-rce-vul… Third Party Advisory
- https://www.vicarius.io/vsociety/posts/cve-2025-59287-mitigation-script-rce-vu… MitigationThird Party Advisory
- https://gist.github.com/hawktrace/880b54fb9c07ddb028baaae401bd3951 Third Party Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-202… Third Party AdvisoryUS Government Resource