WSUS servers: confirm the CVE-2025-59287 fix, close ports 8530 and 8531, and plan for a product no longer developed

CISA urged organizations to apply Microsoft’s October 23, 2025 out-of-band update for CVE-2025-59287, a critical remote code execution flaw in WSUS on Windows Server 2012 through 2025, and added it to the Known Exploited Vulnerabilities catalog. Microsoft also says WSUS is no longer actively developed, though existing capabilities remain.

Source facts

CISA’s alert on CVE-2025-59287 says Microsoft released an update for a critical remote code execution vulnerability in Windows Server Update Services on Windows Server 2012, 2016, 2019, 2022 and 2025 that a prior update did not fully mitigate, and that without it an unauthenticated actor could achieve remote code execution with SYSTEM-level privileges. CISA added the flaw to its Known Exploited Vulnerabilities catalog on October 24, 2025.

CISA’s steps are to identify servers with the WSUS role enabled and TCP ports 8530 or 8531 open, apply the out-of-band update released October 23, 2025 and reboot, or, until that is possible, disable the WSUS role or block inbound traffic to those ports at the host firewall. It also recommends watching for SYSTEM-level child processes spawned from wsusservice.exe or w3wp.exe and for nested PowerShell using base64-encoded commands.

Microsoft’s list of features no longer developed in Windows Server says WSUS is no longer actively developed while its existing capabilities and content remain available. It also says Windows Internal Database, which WSUS can use, will be removed in a future release, and suggests SQL Server for those roles.

Applicability

Use this for any Windows Server with the WSUS role installed, including servers other patch tools depend on. Organizations that patch through cloud services should still look for forgotten WSUS servers.

DSE recommendation

DSE recommends confirming every WSUS server has the CVE-2025-59287 fix and that ports 8530 and 8531 are reachable only from the systems that need them. Keep WSUS off the internet, review those servers for the process activity CISA describes, and begin planning the move to a supported update service because WSUS is no longer being developed.

Verification

Run Get-WindowsFeature -Name UpdateServices across servers to find WSUS installs, confirm the update level on each, and check firewall rules for inbound 8530 and 8531.

Official references

CISA — Microsoft Releases Out-of-Band Security Update to Mitigate Windows Server Update Service Vulnerability, CVE-2025-59287. Microsoft Learn — Features removed or no longer developed starting with Windows Server. Reviewed October 19, 2026.