CVE coverage
View on NVD →
CVE-2025-59287
CVSS 9.8
Actively exploited (KEV)
5 detections found
Deserialization of untrusted data in Windows Server Update Service allows an unauthorized attacker to execute code over a network.
Detection rules
| Source | Rule | Status | Updated |
|---|---|---|---|
| sigma | DNS Query to External Service Interaction Domains | test | 2026-10-13 |
| elastic | Windows Server Update Service Spawning Suspicious Processes | production | 2026-09-18 |
| splunk | Windows WSUS Spawning Shell | production | 2026-05-13 |
| sigma | Exploitation Activity of CVE-2025-59287 - WSUS Suspicious Child Process | experimental | 2025-10-31 |
| sigma | Exploitation Activity of CVE-2025-59287 - WSUS Deserialization | experimental | 2025-10-31 |