{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/wsus-cve-2025-59287-out-of-band-update-ports-8530-8531-no-longer-developed/", "item": { "id": "https://update.dsesecurity.com/updates/wsus-cve-2025-59287-out-of-band-update-ports-8530-8531-no-longer-developed/", "slug": "wsus-cve-2025-59287-out-of-band-update-ports-8530-8531-no-longer-developed", "url": "https://update.dsesecurity.com/updates/wsus-cve-2025-59287-out-of-band-update-ports-8530-8531-no-longer-developed/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/wsus-cve-2025-59287-out-of-band-update-ports-8530-8531-no-longer-developed.md", "json": "https://update.dsesecurity.com/api/v1/posts/wsus-cve-2025-59287-out-of-band-update-ports-8530-8531-no-longer-developed/" }, "title": "WSUS servers: confirm the CVE-2025-59287 fix, close ports 8530 and 8531, and plan for a product no longer developed", "summary": "CISA urged organizations to apply Microsoft’s October 23, 2025 out-of-band update for CVE-2025-59287, a critical remote code execution flaw in WSUS on Windows Server 2012 through 2025, and added it to the Known Exploited Vulnerabilities catalog. Microsoft also says WSUS is no longer actively developed, though existing capabilities remain.", "format": { "slug": "briefing", "name": "Briefing" }, "priority": { "slug": "important", "name": "Important" }, "featured": false, "image": { "theme": "cyber-defense", "label": "Cyber defense", "alt": "Layered glass and metal cyber-defense structure with controlled blue and gold signal paths.", "card_url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "cybersecurity", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "slug": "it", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-10-19T00:27:55+00:00", "modified_at": "2026-10-19T01:55:07+00:00", "reviewed_on": "2026-10-19", "reading_minutes": 2, "word_count": 374, "potentially_affected": "Organizations running the Windows Server Update Services role on any supported Windows Server version, and the providers who manage patching for them.", "dse_recommendation": "DSE recommends confirming every WSUS server has the CVE-2025-59287 fix and that ports 8530 and 8531 are reachable only from the systems that need them.", "primary_source": { "name": "CISA — Microsoft Releases Out-of-Band Security Update to Mitigate Windows Server Update Service Vulnerability, CVE-2025-59287", "url": "https://www.cisa.gov/news-events/alerts/2025/10/24/microsoft-releases-out-band-security-update-mitigate-windows-server-update-service-vulnerability-cve", "published_on": null, "authority": "Cybersecurity and Infrastructure Security Agency" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

CISA urged organizations to apply Microsoft’s October 23, 2025 out-of-band update for CVE-2025-59287, a critical remote code execution flaw in WSUS on Windows Server 2012 through 2025, and added it to the Known Exploited Vulnerabilities catalog. Microsoft also says WSUS is no longer actively developed, though existing capabilities remain.

\n

Source facts

\n

CISA’s alert on CVE-2025-59287 says Microsoft released an update for a critical remote code execution vulnerability in Windows Server Update Services on Windows Server 2012, 2016, 2019, 2022 and 2025 that a prior update did not fully mitigate, and that without it an unauthenticated actor could achieve remote code execution with SYSTEM-level privileges. CISA added the flaw to its Known Exploited Vulnerabilities catalog on October 24, 2025.

\n

CISA’s steps are to identify servers with the WSUS role enabled and TCP ports 8530 or 8531 open, apply the out-of-band update released October 23, 2025 and reboot, or, until that is possible, disable the WSUS role or block inbound traffic to those ports at the host firewall. It also recommends watching for SYSTEM-level child processes spawned from wsusservice.exe or w3wp.exe and for nested PowerShell using base64-encoded commands.

\n

Microsoft’s list of features no longer developed in Windows Server says WSUS is no longer actively developed while its existing capabilities and content remain available. It also says Windows Internal Database, which WSUS can use, will be removed in a future release, and suggests SQL Server for those roles.

\n

Applicability

\n

Use this for any Windows Server with the WSUS role installed, including servers other patch tools depend on. Organizations that patch through cloud services should still look for forgotten WSUS servers.

\n

DSE recommendation

\n

DSE recommends confirming every WSUS server has the CVE-2025-59287 fix and that ports 8530 and 8531 are reachable only from the systems that need them. Keep WSUS off the internet, review those servers for the process activity CISA describes, and begin planning the move to a supported update service because WSUS is no longer being developed.

\n

Verification

\n

Run Get-WindowsFeature -Name UpdateServices across servers to find WSUS installs, confirm the update level on each, and check firewall rules for inbound 8530 and 8531.

\n

Official references

\n

CISA — Microsoft Releases Out-of-Band Security Update to Mitigate Windows Server Update Service Vulnerability, CVE-2025-59287. Microsoft Learn — Features removed or no longer developed starting with Windows Server. Reviewed October 19, 2026.

", "content_text": "CISA urged organizations to apply Microsoft’s October 23, 2025 out-of-band update for CVE-2025-59287, a critical remote code execution flaw in WSUS on Windows Server 2012 through 2025, and added it to the Known Exploited Vulnerabilities catalog. Microsoft also says WSUS is no longer actively developed, though existing capabilities remain.\nSource facts\nCISA’s alert on CVE-2025-59287 says Microsoft released an update for a critical remote code execution vulnerability in Windows Server Update Services on Windows Server 2012, 2016, 2019, 2022 and 2025 that a prior update did not fully mitigate, and that without it an unauthenticated actor could achieve remote code execution with SYSTEM-level privileges. CISA added the flaw to its Known Exploited Vulnerabilities catalog on October 24, 2025.\nCISA’s steps are to identify servers with the WSUS role enabled and TCP ports 8530 or 8531 open, apply the out-of-band update released October 23, 2025 and reboot, or, until that is possible, disable the WSUS role or block inbound traffic to those ports at the host firewall. It also recommends watching for SYSTEM-level child processes spawned from wsusservice.exe or w3wp.exe and for nested PowerShell using base64-encoded commands.\nMicrosoft’s list of features no longer developed in Windows Server says WSUS is no longer actively developed while its existing capabilities and content remain available. It also says Windows Internal Database, which WSUS can use, will be removed in a future release, and suggests SQL Server for those roles.\nApplicability\nUse this for any Windows Server with the WSUS role installed, including servers other patch tools depend on. Organizations that patch through cloud services should still look for forgotten WSUS servers.\nDSE recommendation\nDSE recommends confirming every WSUS server has the CVE-2025-59287 fix and that ports 8530 and 8531 are reachable only from the systems that need them. Keep WSUS off the internet, review those servers for the process activity CISA describes, and begin planning the move to a supported update service because WSUS is no longer being developed.\nVerification\nRun Get-WindowsFeature -Name UpdateServices across servers to find WSUS installs, confirm the update level on each, and check firewall rules for inbound 8530 and 8531.\nOfficial references\nCISA — Microsoft Releases Out-of-Band Security Update to Mitigate Windows Server Update Service Vulnerability, CVE-2025-59287. Microsoft Learn — Features removed or no longer developed starting with Windows Server. Reviewed October 19, 2026.", "content_markdown": "CISA urged organizations to apply Microsoft’s October 23, 2025 out-of-band update for CVE-2025-59287, a critical remote code execution flaw in WSUS on Windows Server 2012 through 2025, and added it to the Known Exploited Vulnerabilities catalog. Microsoft also says WSUS is no longer actively developed, though existing capabilities remain.\n\n## Source facts\n\nCISA’s [alert on CVE-2025-59287](https://www.cisa.gov/news-events/alerts/2025/10/24/microsoft-releases-out-band-security-update-mitigate-windows-server-update-service-vulnerability-cve) says Microsoft released an update for a critical remote code execution vulnerability in Windows Server Update Services on Windows Server 2012, 2016, 2019, 2022 and 2025 that a prior update did not fully mitigate, and that without it an unauthenticated actor could achieve remote code execution with SYSTEM-level privileges. CISA added the flaw to its Known Exploited Vulnerabilities catalog on October 24, 2025.\n\nCISA’s steps are to identify servers with the WSUS role enabled and TCP ports 8530 or 8531 open, apply the out-of-band update released October 23, 2025 and reboot, or, until that is possible, disable the WSUS role or block inbound traffic to those ports at the host firewall. It also recommends watching for SYSTEM-level child processes spawned from wsusservice.exe or w3wp.exe and for nested PowerShell using base64-encoded commands.\n\nMicrosoft’s [list of features no longer developed in Windows Server](https://learn.microsoft.com/en-us/windows-server/get-started/removed-deprecated-features-windows-server) says WSUS is no longer actively developed while its existing capabilities and content remain available. It also says Windows Internal Database, which WSUS can use, will be removed in a future release, and suggests SQL Server for those roles.\n\n## Applicability\n\nUse this for any Windows Server with the WSUS role installed, including servers other patch tools depend on. Organizations that patch through cloud services should still look for forgotten WSUS servers.\n\n## DSE recommendation\n\nDSE recommends confirming every WSUS server has the CVE-2025-59287 fix and that ports 8530 and 8531 are reachable only from the systems that need them. Keep WSUS off the internet, review those servers for the process activity CISA describes, and begin planning the move to a supported update service because WSUS is no longer being developed.\n\n## Verification\n\nRun Get-WindowsFeature -Name UpdateServices across servers to find WSUS installs, confirm the update level on each, and check firewall rules for inbound 8530 and 8531.\n\n## Official references\n\n[CISA — Microsoft Releases Out-of-Band Security Update to Mitigate Windows Server Update Service Vulnerability, CVE-2025-59287](https://www.cisa.gov/news-events/alerts/2025/10/24/microsoft-releases-out-band-security-update-mitigate-windows-server-update-service-vulnerability-cve). [Microsoft Learn — Features removed or no longer developed starting with Windows Server](https://learn.microsoft.com/en-us/windows-server/get-started/removed-deprecated-features-windows-server). Reviewed October 19, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/wsus-cve-2025-59287-out-of-band-update-ports-8530-8531-no-longer-developed/", "url": "https://update.dsesecurity.com/updates/wsus-cve-2025-59287-out-of-band-update-ports-8530-8531-no-longer-developed/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-10-19" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/wsus-cve-2025-59287-out-of-band-update-ports-8530-8531-no-longer-developed/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "WSUS servers: confirm the CVE-2025-59287 fix, close ports 8530 and 8531, and plan for a product no longer developed", "item": "https://update.dsesecurity.com/updates/wsus-cve-2025-59287-out-of-band-update-ports-8530-8531-no-longer-developed/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/wsus-cve-2025-59287-out-of-band-update-ports-8530-8531-no-longer-developed/#article", "identifier": "https://update.dsesecurity.com/updates/wsus-cve-2025-59287-out-of-band-update-ports-8530-8531-no-longer-developed/", "url": "https://update.dsesecurity.com/updates/wsus-cve-2025-59287-out-of-band-update-ports-8530-8531-no-longer-developed/", "headline": "WSUS servers: confirm the CVE-2025-59287 fix, close ports 8530 and 8531, and plan for a product no longer developed", "description": "CISA urged organizations to apply Microsoft’s October 23, 2025 out-of-band update for CVE-2025-59287, a critical remote code execution flaw in WSUS on…", "abstract": "CISA urged organizations to apply Microsoft’s October 23, 2025 out-of-band update for CVE-2025-59287, a critical remote code execution flaw in WSUS on Windows Server 2012 through 2025, and added it to the Known Exploited Vulnerabilities catalog. Microsoft also says WSUS is no longer actively developed, though existing capabilities remain.", "articleBody": "CISA urged organizations to apply Microsoft’s October 23, 2025 out-of-band update for CVE-2025-59287, a critical remote code execution flaw in WSUS on Windows Server 2012 through 2025, and added it to the Known Exploited Vulnerabilities catalog. Microsoft also says WSUS is no longer actively developed, though existing capabilities remain.\nSource facts\nCISA’s alert on CVE-2025-59287 says Microsoft released an update for a critical remote code execution vulnerability in Windows Server Update Services on Windows Server 2012, 2016, 2019, 2022 and 2025 that a prior update did not fully mitigate, and that without it an unauthenticated actor could achieve remote code execution with SYSTEM-level privileges. CISA added the flaw to its Known Exploited Vulnerabilities catalog on October 24, 2025.\nCISA’s steps are to identify servers with the WSUS role enabled and TCP ports 8530 or 8531 open, apply the out-of-band update released October 23, 2025 and reboot, or, until that is possible, disable the WSUS role or block inbound traffic to those ports at the host firewall. It also recommends watching for SYSTEM-level child processes spawned from wsusservice.exe or w3wp.exe and for nested PowerShell using base64-encoded commands.\nMicrosoft’s list of features no longer developed in Windows Server says WSUS is no longer actively developed while its existing capabilities and content remain available. It also says Windows Internal Database, which WSUS can use, will be removed in a future release, and suggests SQL Server for those roles.\nApplicability\nUse this for any Windows Server with the WSUS role installed, including servers other patch tools depend on. Organizations that patch through cloud services should still look for forgotten WSUS servers.\nDSE recommendation\nDSE recommends confirming every WSUS server has the CVE-2025-59287 fix and that ports 8530 and 8531 are reachable only from the systems that need them. Keep WSUS off the internet, review those servers for the process activity CISA describes, and begin planning the move to a supported update service because WSUS is no longer being developed.\nVerification\nRun Get-WindowsFeature -Name UpdateServices across servers to find WSUS installs, confirm the update level on each, and check firewall rules for inbound 8530 and 8531.\nOfficial references\nCISA — Microsoft Releases Out-of-Band Security Update to Mitigate Windows Server Update Service Vulnerability, CVE-2025-59287. Microsoft Learn — Features removed or no longer developed starting with Windows Server. Reviewed October 19, 2026.", "datePublished": "2026-10-19T00:27:55+00:00", "dateModified": "2026-10-19T01:55:07+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/wsus-cve-2025-59287-out-of-band-update-ports-8530-8531-no-longer-developed/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/wsus-cve-2025-59287-out-of-band-update-ports-8530-8531-no-longer-developed/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "WSUS servers: confirm the CVE-2025-59287 fix, close ports 8530 and 8531, and plan for a product no longer developed" }, "articleSection": [ "Cybersecurity", "IT" ], "keywords": [ "Cybersecurity", "IT", "Briefing", "Important priority" ], "genre": "Briefing", "about": [ { "@type": "Thing", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "Thing", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "wordCount": 374, "timeRequired": "PT2M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "CISA — Microsoft Releases Out-of-Band Security Update to Mitigate Windows Server Update Service Vulnerability, CVE-2025-59287", "url": "https://www.cisa.gov/news-events/alerts/2025/10/24/microsoft-releases-out-band-security-update-mitigate-windows-server-update-service-vulnerability-cve" } } ] } }