WSUS AuthorizationCookie Deserialization RCE

aka WSUS RCE

Product: Microsoft Windows Server Update Services (WSUS)
CVE: CVE-2025-59287
Disclosed: 2025-10-14
CVSS: 9.8
Auth: pre-auth
CISA KEV: yes
Affected: Windows Server 2012 through Server 2025 with the WSUS Server role enabled.
Fixed: Out-of-band update of 23 October 2025 (the 14 October Patch Tuesday fix was incomplete).

Summary

An unauthenticated deserialization bug in WSUS, the server that distributes Windows updates inside enterprises. After public PoCs appeared, Microsoft shipped an emergency out-of-band patch and attacks on WSUS on ports 8530/8531 began within hours.

Root cause

WSUS deserializes attacker-controlled data without type restrictions in its unauthenticated web services. Early analysis (HawkTrace) pointed to the GetCookie endpoint decrypting an AuthorizationCookie (AES-128-CBC) and passing it to BinaryFormatter, the path most public PoCs and in-the-wild exploitation used. HawkTrace later attributed that path to CVE-2023-35317 and described CVE-2025-59287 as a SoapFormatter deserialization: event data submitted to ReportingWebService (ReportEventBatch) is stored in tbEventInstance and later deserialized from its MiscData field. Either way the gadget runs as SYSTEM.

Impact

Unauthenticated SYSTEM-level RCE on WSUS servers, which are trusted to push software to every managed endpoint.

Public PoC

<!-- sent to /ReportingWebService/ReportingWebService.asmx (ReportEventBatch);
     stored in tbEventInstance and later passed to SoapFormatter -->
<MiscData soapenc:arrayType="xsd:string[2]">
  <string>Administrator=SYSTEM</string>
  <string>SynchronizationUpdateErrorsKey=<SOAP-ENV:Envelope ...>
    <SOAP-ENV:Body>
      <a1:DataSet id="ref-1" ...> <!-- DataSet wrapper, RemotingFormat=Binary -->
        ...<DataSet.Tables_0 href="#ref-4"/></a1:DataSet>
      <SOAP-ENC:Array id="ref-4" xsi:type="SOAP-ENC:base64">[BinaryFormatter gadget: cmd /c calc]</SOAP-ENC:Array>
    </SOAP-ENV:Body></SOAP-ENV:Envelope></string>
</MiscData>

Source: HawkTrace - CVE-2025-59287 WSUS Unauthenticated RCE

Detection

Watch for w3wp.exe (WsusPool) or WsusService.exe spawning cmd/powershell, and POST requests to /ClientWebService/Client.asmx and /ReportingWebService/ReportingWebService.asmx from unexpected sources. Check for the 23 October 2025 update.

Mitigation

Install the out-of-band update and reboot. Workaround: disable the WSUS role or block inbound TCP 8530/8531 at the host firewall.