Back to the CVE list
CVE-2025-59287 CISA KEV · Actively exploited

Windows Server Update Service (WSUS) Remote Code Execution Vulnerability

CVSS score

9.8

EPSS probability

%100.0

Risk score

19.6

Published

1 y ago

Public Exploits · GitHub and Metasploit Intelligence

This tab scans the sources that NVD labels as exploits, GitHub repositories matching the CVE identifier and Rapid7 Metasploit Framework modules. Only links to sources that were actually found are shown.

owaset55-crypto/CVE-2025-59287

Public PoCSource updated: 23.07.2026 05:32:14

swoon69/CVE-2025-59287-Exercise-Use

Public PoCSource updated: 09.03.2026 08:10:44

ross-ns/WSUS-CVE-2025-59287

Public PoCSource updated: 18.02.2026 14:11:06

LuemmelSec/CVE-2025-59287---WSUS-SCCM-RCE

Public PoCSource updated: 19.04.2026 01:27:24

Unauthenticated RCE PoC in Microsoft Windows Server Update Service (WSUS) - CVE-2025-59287 & CVE-2023-35317

Public PoCSource updated: 24.08.2026 15:09:11

Adel-hx0d/cve-2025-59287

Public PoCSource updated: 21.11.2025 12:54:01

Twodimensionalitylevelcrossing817/CVE-2025-59287

Public PoCSource updated: 19.11.2025 11:39:12

Exploit script written in C# to aid gaining a reverse shell on targets with Windows Server Update Service(WSUS) CVE-2025-59287.

Public PoCSource updated: 25.09.2026 12:05:40

Exploitation proof-of-concept for CVE-2025-59287 - a critical vulnerability in the Windows Server Update Service (WSUS) caused by the deserialization of untrusted data. This flaw allows an unauthorized attacker to execute arbitrary code over a network, posing a significant security risk.

Public PoCSource updated: 08.01.2026 23:45:21

WSUS Unauthenticated RCE (★27)

Public PoCSource updated: 26.10.2025 03:13:50

Defensive PoC decoy for CVE-2025-59287 (WSUS) - emulates WSUS endpoints, captures request bodies and metadata, saves evidence for forensic analysis, and provides validation harness and detection rules. (★1)

Public PoCSource updated: 27.10.2025 20:17:55

powershell version of hawktrace POC exploit (★1)

Public PoCSource updated: 28.10.2025 00:37:48

CVE-2025-59287 — Critical unauthenticated RCE in Windows Server Update Services (WSUS) via unsafe deserialization of an AuthorizationCookie, enabling SYSTEM-level compromise and active exploitation; patch or isolate WSUS (ports 8530/8531) immediately. (★1)

Public PoCSource updated: 28.10.2025 16:56:22

Guía de respuesta rápida y script de auditoría para CVE-2025-59287 (RCE crítica en WSUS). (★1)

Public PoCSource updated: 29.10.2025 07:25:07

Verificacion de vulnerabilidad en WSUS (★1)

Public PoCSource updated: 29.10.2025 21:03:40

PoC from hawktrace (★0)

Public PoCSource updated: 20.10.2025 23:02:21

PoC for Remote Code Execution Vulnerability in Windows Server Update Service by Microsoft CVE-2025-59287 9.8 CRITICAL (★0)

Public PoCSource updated: 25.10.2025 23:17:25

It is an Working exploit of new CVE found in WSUS. (★0)

Public PoCSource updated: 26.10.2025 02:24:01

PoC for CVE-2025-59287 (★0)

Public PoCSource updated: 27.10.2025 11:03:06

CVE-2025-59287 (★0)

Public PoCSource updated: 29.10.2025 03:56:55

Module PowerShell de réponse à l'incident CVE-2025-59287 — WSUS Remote Code Execution (RCE) (★0)

Public PoCSource updated: 28.10.2025 01:48:49

CVE-2025-59287 is a critical RCE vulnerability in Windows Server Update Services (WSUS) caused by unsafe deserialization of untrusted data. It allows remote attackers to execute arbitrary code without authentication. Urgent patching is advised due to active exploitation. (★0)

Public PoCSource updated: 28.10.2025 15:37:10

Nuclei: Windows Server Update Service - Insecure Deserialization

Exploit reference

Similar Vulnerabilities

Get this vulnerability through the API

Affected products, version ranges, exploitation status and patch information in a single request, with a free key.

curl -H "x-api-key: $DAYBREACH_API_KEY" \
  "https://api.daybreach.dev/api/v1/intel/cves/CVE-2025-59287"