{
  "_links": {
    "capec": {
      "href": "/api/v1/vulnerability/cve-2025-59287/capec"
    },
    "cvss": {
      "href": "/api/v1/vulnerability/cve-2025-59287/cvss"
    },
    "cwe": {
      "href": "/api/v1/vulnerability/cve-2025-59287/cwe"
    },
    "enrichment": {
      "href": "/api/v1/vulnerability/cve-2025-59287/enrichment"
    },
    "gcve": {
      "href": "/api/v1/vulnerability/cve-2025-59287/gcve"
    },
    "self": {
      "href": "/api/v1/vulnerability/cve-2025-59287/enrichment"
    },
    "sightings": {
      "href": "/api/v1/sightings/cve-2025-59287"
    },
    "vulnerability": {
      "href": "/api/v1/vulnerability/cve-2025-59287"
    }
  },
  "enrichments": {
    "cisa-kev": {
      "kev": true
    },
    "epss": {
      "epss": 0.9998,
      "kev": true,
      "percentile": 0.99981
    },
    "nuclei": {
      "nuclei": true,
      "nuclei_template": "http/cves/2025/CVE-2025-59287.yaml",
      "nuclei_template_severity": "critical",
      "nuclei_template_yaml": "id: CVE-2025-59287\n\ninfo:\n  name: Windows Server Update Service - Insecure Deserialization\n  author: pussycat0x,princechaddha\n  severity: critical\n  description: |\n    Windows Server Update Service contains an insecure deserialization vulnerability caused by deserialization of untrusted data. An unauthorized attacker with network access can exploit this to execute arbitrary code remotely, potentially leading to full system compromise.\n  impact: |\n    Unauthenticated attackers can exploit unsafe deserialization to execute arbitrary code remotely on Windows Server Update Service systems, achieving complete server compromise.\n  remediation: |\n    Apply the Microsoft security patches as described in the MSRC update guide for Windows Server Update Service and restrict network access to WSUS endpoints.\n  reference:\n    - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-59287\n    - https://www.huntress.com/blog/exploitation-of-windows-server-update-services-remote-code-execution-vulnerability\n    - https://hawktrace.com/blog/CVE-2025-59287\n    - https://research.eye.security/wsus-deserialization-exploit-in-the-wild-cve-2025-59287\n    - https://unit42.paloaltonetworks.com/microsoft-cve-2025-59287/\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    cve-id: CVE-2025-59287\n    cwe-id: CWE-502\n    epss-score: 0.9998\n    epss-percentile: 0.99981\n    cpe: cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*\n  metadata:\n    verified: true\n    max-request: 4\n    vendor: microsoft\n    product: windows_server_update_service\n    shodan-query: cpe:\"cpe:2.3:o:microsoft:windows_server_2012\"\n  tags: cve,cve2025,windows,server,wsus,kev,vkev,deserialization,rce,vuln\n\nvariables:\n  domain: \"{{rand_text_alphanumeric(5)}}.local\"\n\nflow: http(1) && http(2) && http(3) && http(4)\n\nhttp:\n  - raw:\n      - |\n        POST /ReportingWebService/ReportingWebService.asmx HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: text/xml; charset=utf-8\n        SOAPAction: \"http://www.microsoft.com/SoftwareDistribution/GetRollupConfiguration\"\n        Content-Type: text/xml\n        Content-Length: 331\n\n        <?xml version=\"1.0\" encoding=\"utf-8\"?>\n        <soap:Envelope xmlns:soap=\"http://schemas.xmlsoap.org/soap/envelope/\">\n          <soap:Body>\n            <GetRollupConfiguration xmlns=\"http://www.microsoft.com/SoftwareDistribution\">\n                <cookie xmlns:i=\"http://www.w3.org/2001/XMLSchema-instance\" i:nil=\"true\"/>\n            </GetRollupConfiguration>\n          </soap:Body>\n        </soap:Envelope>\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'contains(body, \"RollupResetGuid\")'\n          - 'contains(header, \"text/xml\")'\n          - 'status_code == 200'\n        condition: and\n        internal: true\n\n    extractors:\n      - type: regex\n        part: body\n        name: ServerId\n        group: 1\n        regex:\n          - '<ServerId>(.*)</ServerId>'\n        internal: true\n\n  - raw:\n      - |\n        POST /SimpleAuthWebService/SimpleAuth.asmx HTTP/1.1\n        Host: {{Hostname}}\n        SOAPAction: \"http://www.microsoft.com/SoftwareDistribution/Server/SimpleAuthWebService/GetAuthorizationCookie\"\n        Content-Type: text/xml\n        Content-Length: 413\n\n        <?xml version=\"1.0\" encoding=\"utf-8\"?>\n        <soap:Envelope xmlns:soap=\"http://schemas.xmlsoap.org/soap/envelope/\">\n          <soap:Body>\n            <GetAuthorizationCookie xmlns=\"http://www.microsoft.com/SoftwareDistribution/Server/SimpleAuthWebService\">\n              <clientId>{{ServerId}}</clientId>\n              <targetGroupName></targetGroupName>\n              <dnsName>{{domain}}</dnsName>\n            </GetAuthorizationCookie>\n          </soap:Body>\n        </soap:Envelope>\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'contains(body, \"CookieData\")'\n          - 'contains(header, \"text/xml\")'\n          - 'status_code == 200'\n        condition: and\n        internal: true\n\n    extractors:\n      - type: regex\n        part: body\n        name: cookie\n        group: 1\n        regex:\n          - '<CookieData>(.*)</CookieData>'\n        internal: true\n\n  - raw:\n      - |\n        POST /ClientWebService/Client.asmx HTTP/1.1\n        Host: {{Hostname}}\n        SOAPAction: \"http://www.microsoft.com/SoftwareDistribution/Server/ClientWebService/GetCookie\"\n        Content-Type: text/xml\n        Content-Length: 413\n\n        <?xml version=\"1.0\" encoding=\"utf-8\"?>\n          <soap:Envelope xmlns:soap=\"http://schemas.xmlsoap.org/soap/envelope/\">\n          <soap:Body>\n        <GetCookie xmlns=\"http://www.microsoft.com/SoftwareDistribution/Server/ClientWebService\">\n          <authCookies>\n            <AuthorizationCookie>\n              <PlugInId>SimpleTargeting</PlugInId>\n              <CookieData>{{cookie}}</CookieData>\n            </AuthorizationCookie>\n            </authCookies>\n            <oldCookie xmlns:i=\"http://www.w3.org/2001/XMLSchema-instance\" i:nil=\"true\"/>\n          <lastChange>{{date_time(\"%Y-%M-%DT%H:%m:%sZ\")}}</lastChange>\n            <currentTime>{{date_time(\"%Y-%M-%DT%H:%m:%sZ\")}}</currentTime>\n            <protocolVersion>1.20</protocolVersion>\n        </GetCookie>\n        </soap:Body>\n        </soap:Envelope>\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'contains(body, \"GetCookieResult\")'\n          - 'contains(header, \"text/xml\")'\n          - 'status_code == 200'\n        condition: and\n        internal: true\n\n    extractors:\n      - type: regex\n        part: body\n        group: 1\n        name: EncryptedData\n        regex:\n          - <EncryptedData>(.*)</EncryptedData>\n        internal: true\n\n  - raw:\n      - |\n        POST /ReportingWebService/ReportingWebService.asmx HTTP/1.1\n        Host: {{Hostname}}\n        Accept: text/xml\n        Connection: keep-alive\n        Content-Type: text/xml\n        SOAPAction: \"http://www.microsoft.com/SoftwareDistribution/ReportEventBatch\"\n        Content-Length: 4464\n\n        <soap:Envelope xmlns:soap=\"http://schemas.xmlsoap.org/soap/envelope/\" xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\" xmlns:xsd=\"http://www.w3.org/2001/XMLSchema\" xmlns:soapenc=\"http://schemas.xmlsoap.org/soap/encoding/\">\n        <soap:Body>\n        <ReportEventBatch xmlns=\"http://www.microsoft.com/SoftwareDistribution\">\n        <cookie>\n        <Expiration>{{date_time(\"%Y-%M-%DT%H:%m:%sZ\")}}</Expiration>\n        <EncryptedData>{{EncryptedData}}</EncryptedData>\n        </cookie>\n        <clientTime>{{date_time(\"%Y-%M-%DT%H:%m:%sZ\")}}</clientTime>\n        <eventBatch xmlns:q1=\"http://www.microsoft.com/SoftwareDistribution\" soapenc:arrayType=\"q1:ReportingEvent[1]\">\n        <ReportingEvent>\n        <BasicData>\n        <TargetID>\n        <Sid>549743e5-8546-4f9d-b946-7948711f7b69</Sid>\n        </TargetID>\n        <SequenceNumber>0</SequenceNumber>\n        <TimeAtTarget>2025-10-29T08:41:54.069</TimeAtTarget>\n        <EventInstanceID>a0ce0892-6046-4f21-856e-69ffa43876b9</EventInstanceID>\n        <NamespaceID>2</NamespaceID>\n        <EventID>389</EventID>\n        <SourceID>301</SourceID>\n        <UpdateID>\n        <UpdateID>00000000-0000-0000-0000-000000000000</UpdateID>\n        <RevisionNumber>0</RevisionNumber>\n        </UpdateID>\n        <Win32HResult>0</Win32HResult>\n        <AppName>LocalServer</AppName>\n        </BasicData>\n        <ExtendedData>\n        <MiscData soapenc:arrayType=\"xsd:string[2]\">\n        <string>Administrator=SYSTEM</string>\n        <string>{{randstr}}</string>\n        </MiscData>\n        </ExtendedData>\n        <PrivateData>\n        <ComputerDnsName></ComputerDnsName>\n        <UserAccountName></UserAccountName>\n        </PrivateData>\n        </ReportingEvent>\n        </eventBatch>\n        </ReportEventBatch>\n        </soap:Body>\n        </soap:Envelope>\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'contains(body, \"ReportEventBatchResult>true</ReportEventBatchResult>\")'\n          - 'contains(header, \"text/xml\")'\n          - 'status_code == 200'\n        condition: and\n# digest: 4a0a00473045022100f5bdc4f1fd675b8dd3f1d7e18cfccf3e79bcbdb491008538e366d4866bad2531022020e5dadbcac797beaa85485e27b512c45fd6576644276a5f8b4e7c23a9191196:922c64590222798bb761d5b6d8e72950"
    }
  },
  "vuln_id": "cve-2025-59287"
}