Exploited vulnerabilitiesBriefPublic record
Microsoft WSUS deserialization RCE (CVE-2025-59287)
Out-of-band patch 23 Oct 2025. KEV: 24 Oct 2025.
- Disclosed
What happened
- Out-of-band patch 23 Oct 2025. KEV: 24 Oct 2025. Exploited after the PoC.
Live scores
Live scores
CVE-2025-59287- EPSS
- 1.000
very likely to be attacked soon - VEDAS
- 0.981
strong exploit evidence - On CISA KEV
- Yes, since 2025-10-24
Thin horizontal line: the “likely” (EPSS 0.10) or “strong” (VEDAS 0.90) threshold. Shaded “no data” areas are periods when cve-scores did not publish.
Sources
This is a brief: a short, sourced summary from our incident tracking. Full advisories add commands to check whether you are affected.