Critical RCE Vulnerability in Windows Server Update Services Actively Exploited

Microsoft has released an out-of-band security update for a critical vulnerability, CVE-2025-59287, in Windows Server Update Services (WSUS) that allows unauthenticated remote code execution. The vulnerability, stemming from insecure deserialization of untrusted data, is being actively exploited in the wild, affecting multiple organizations, particularly in the U.S. Security agencies, including CISA, have urged immediate patching to mitigate potential attacks.