Detection for WSUS Remote Code Execution (CVE-2025-59287)

Wambua Thyaka@thyaka

•updated Oct 27, 2025•22•2•675

This query looks for indicators of CVE-2025-59287 exploitation, a critical WSUS deserialization flaw (CVSS 9.8) enabling unauthenticated remote code execution. Focuses on network, process, and file artifacts associated with exploitation.