Warnings Mount Over Windows Server Update Services Hacks

Warnings over hackers exploiting a Windows Server Update have compounded since Microsoft rushed out a patch Friday against a flaw allowing unauthenticated attackers to execute arbitrary code.

See Also: On Demand | From Patch to Prevention: Modernizing Remediation Across Hybrid Environments

The flaw, tracked as CVE-2025-59287 is a deserialization of untrusted data in the Windows Server Update Service. Microsoft describes the flaw’s source as a “legacy serialization mechanism.” Windows Server Update Services, a tool for managing Microsoft’s many updates, itself is no longer under active development.

The Cybersecurity and Infrastructure Security Agency added the vulnerability to its Known Exploited Vulnerabilities catalog on Friday. Cybersecurity firms Eye Security and Palo Alto Networks Unit 42 say they’ve observed active hacks and that thousands of Windows Server Update Services appear exposed to the internet. Unit 42 characterized the attacks as focused on reconnaissance likely as “a precursor to broader network compromise.”

By compromising a single server, an attacker could take over the entire patch distribution system to gain system-level control to potentially carry out an internal supply chain attack, said Justin Moore, senior manager of threat intel research at Unit 42.

“They can push malware to every workstation and server in the organization, all disguised as a legitimate Microsoft update. This turns the trusted service into a weapon of mass distribution,” he said.

The Canadian Center for Cybersecurity and the Australian Cyber Security Centre also published alerts about the flaw.

Microsoft attempted to head off hackers exploiting this flaw through a normal Patch Tuesday fix pushed out on Oct. 15. The patch didn’t fully resolve the issue – meaning that a proof of concept published by HawkTrace shortly afterward had a greater reach than it otherwise might have had.

“In the brief window between the flawed initial patch and the emergency fix, threat actors weaponized this vulnerability almost instantaneously, granting them a critical head start before the complete remediation was available,” Moore said.

Attackers can use multiple attack paths including one that takes advantage of how Windows Server Update Services deserializes AuthorizationCookie objects. That attack method allows a threat actor to send “malicious encrypted cookies to the GetCookie() endpoint,” HawkTrace wrote in a follow up blog post. Another path is through ReportingWebService, through which unsafe deserialization can be triggered via SoapFormatter.

“The vulnerability is particularly concerning because its target, WSUS, is often neglected,” Moore said. “Many IT teams adopt a ‘set it and forget it’ posture, leaving it a vulnerable target. A WSUS server should never be exposed to the Internet, it’s an internal patch system, not a public target.”