{"uuid": "1f1cc539-4300-4572-9178-568a69114a78", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-59287", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/http/wsus_deserialization_rce.rb", "content": "{\"aliases\": [], \"arch\": \"cmd\", \"author\": [\"mwulftange\", \"msutovsky-r7\"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": true, \"default_credential\": false, \"description\": \"This module exploits deserialization vulnerability in legacy serialization mechanism in Windows Server Update Services (WSUS). The vulnerability allows unauthenticated attacker to create specially crafted event, which triggers unsafe deserialization upon server synchronization. The module does not require any other options and upon successful exploitation, the payload is executed in context of administrator.\", \"disclosure_date\": \"2025-10-14\", \"fullname\": \"exploit/windows/http/wsus_deserialization_rce\", \"is_install_path\": true, \"mod_time\": \"2025-11-10 18:32:13 +0000\", \"name\": \"Windows Server Update Service Deserialization Remote Code Execution\", \"needs_cleanup\": null, \"notes\": {\"Reliability\": [\"repeatable-session\"], \"SideEffects\": [\"ioc-in-logs\", \"screen-effects\"], \"Stability\": [\"crash-service-restarts\"]}, \"path\": \"/modules/exploits/windows/http/wsus_deserialization_rce.rb\", \"platform\": \"Windows\", \"post_auth\": false, \"rank\": 500, \"ref_name\": \"windows/http/wsus_deserialization_rce\", \"references\": [\"ATT&CK-T1190\", \"URL-https://code-white.com/blog/wsus-cve-2025-59287-analysis/\", \"CVE-2025-59287\"], \"rport\": \"8530\", \"session_types\": false, \"targets\": [\"Windows\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:52:02.082973Z"}