Backstory
Windows Server Update Services is a SOAP web service built on the .NET Framework. Microsoft's protocol specification records that the update-server protocol was implemented by the WSUS component in Windows 2000 Server Service Pack 3 and later, and lists every Windows Server release from 2003 through 2025 as an implementer. The same specification notes that although all applicable releases support HTTPS, "SSL is not configured by default when WSUS is installed." Paul Stone and Alex Chapman reported that default at Black Hat USA 2015, writing in the WSUSpect paper that "By default, WSUS does not use SSL for the SOAP web service." Microsoft's response then was configuration guidance rather than a code change.
The protocol also moves serialized .NET objects across the network by design. Microsoft's specification describes the authorization cookie's EncryptedData field as the server identity, target groups and expiration time converted "into a sequence of bytes" and then encrypted. WSUS implemented one version of that decrypt-then-deserialize pattern using BinaryFormatter, the serializer shipped in the first .NET Framework release in 2002, which Microsoft's own guidance now describes as "insecure and can't be made secure." Microsoft replaced that BinaryFormatter call in the WSUS EncryptionHelper class with XmlSerializer in the July 2023 update, addressing CVE-2023-35317.
Microsoft spent the following years retiring these formatters everywhere except the runtime WSUS actually uses. BinaryFormatter was obsoleted in .NET 5 under SYSLIB0011, made to throw at runtime in .NET 8, and removed outright in .NET 9 after a February 2024 announcement that cited an Exchange deserialization bug, CVE-2021-42321, as the motivating example. SoapFormatter sits in the same guidance under "dangerous alternatives," which "all perform unrestricted polymorphic deserialization and are dangerous, just like BinaryFormatter." None of that removal reaches WSUS: the vulnerable assembly targets .NET Framework 4.5, and .NET Framework never removed the runtime formatters.
Microsoft deprecated WSUS on September 20, 2024, stating that it was "no longer investing in new capabilities" while "preserving current functionality," and directed customers toward Windows Autopatch, Microsoft Intune and Azure Update Manager. The same notice confirmed "no current plans of removing WSUS from in-market versions of Windows Server (including Windows Server 2025)." Microsoft Learn still describes the role as supported for production deployments and receiving security and quality updates, and the Windows Server 2025 deprecated-features table records that "all the existing capabilities and content continue to be available for your deployments."
Technical analysis (revisited)
The original analyst note, written on October 14, 2025, described the bug correctly at the level that matters operationally: an unauthenticated attacker sends a crafted message to a network-listening WSUS service, the service deserializes it unsafely, and the attacker's input executes as code at SYSTEM. Microsoft's advisory FAQ says the same, that "a remote, unauthenticated attacker could send a crafted event that triggers unsafe object deserialization in a legacy serialization mechanism." CWE-502, CVSS 9.8.
The specifics took longer to settle, and much of the public record settled wrong. On October 29, Markus Wulftange of CODE WHITE published a binary diff of Microsoft.UpdateServices.BaseApi.dll across three builds and located the sink in Microsoft.UpdateServices.Internal.Reporting.ReportingEvent.Validate(), reachable unauthenticated through the ReportEventBatch method on /ReportingWebService/ReportingWebService.asmx by way of the SynchronizationUpdateErrorsKey entry in ExtendedData.MiscData. Deserialization ran through SoapFormatter behind a WSUSDeserializationBinder that substitutes a full assembly name before calling Type.GetType() and imposes no type restriction. The October 23 out-of-band update replaced the call with a thrown exception.
Two details from that diff are worth stating plainly. The October 14 build was the first of the three to contain the SoapUtilities.DeserializeObject call inside Validate(), and Wulftange recorded that "it's still not quite clear what the security update of October 2025 actually fixed as we did not find any other security related change between September and October 2025 except for the introduction of the SoapFormatter sink path." Separately, most published writeups, including our own October 14 note's framing of the flaw, describe a BinaryFormatter bug in GetCookie() and EncryptionHelper.DecryptData(). That description belongs to CVE-2023-35317. The blog it propagated from now carries a correction: "the vulnerability was mentioned in the blog post with an incorrect CVE number. The CVE number for this post is CVE-2023-35317." Unit 42's analysis documents both an AuthorizationCookie path and the ReportingWebService SoapFormatter path.
Lifecycle timeline
Real-world outcome
The note of October 14 recorded no known public exploits and named the CVE a candidate for future KEV inclusion. A proof of concept appeared publicly three days later. Microsoft shipped the out-of-band update on October 23, and Huntress observed exploitation of internet-exposed WSUS instances on ports 8530 and 8531 beginning around 23:34 UTC that same day. CISA added the CVE to KEV on October 24, ten days after the note.
The first wave was reconnaissance rather than encryption. Huntress logged whoami, net user /domain and ipconfig /all running under a distinctive wsusservice.exe or w3wp.exe to cmd.exe to powershell.exe ancestry, with results base64-encoded and posted to webhook endpoints. Sophos independently recorded six incidents from 02:53 UTC on October 24 at universities, technology, manufacturing and healthcare organizations, harvesting external IP, Active Directory domain user lists and network interface configurations. Eye Security captured a payload at 06:09:25 UTC on October 24 that was not the public proof of concept, a .NET stub that executes the value of an aaaa request header through cmd.exe, keeping the actual commands out of request logs. Darktrace traced two victims past reconnaissance into workers.dev C2 beaconing, abuse of the Velociraptor DFIR tool as a tunnel, and the Skuld infostealer by October 26. AhnLab observed the ShadowPad backdoor installed through this CVE on November 6, sideloaded via a legitimate signed binary, with attribution stated only at the tooling level.
Exposure estimates diverged by method: Unit 42's Cortex Xpanse counted roughly 5,500 publicly exposed instances, Eye Security roughly 8,000. Huntress found only about 25 susceptible hosts across its own partner base and noted that WSUS is not often exposed on those ports. KEV still records knownRansomwareCampaignUse as Unknown.
The slower aftermath shows up in the CVE record itself. WSUS has shipped as a Windows Server role since 2005, and before this one the component had two CVEs in its entire history, both assigned on the same day in July 2023. In the nine months after CVE-2025-59287 was patched, researchers filed more WSUS vulnerabilities than the role had accumulated in its first eighteen years: input-validation and tampering flaws in January and April 2026, a use-after-free and a race condition in April, and a missing-authentication issue and an uncaught exception in July 2026.
Lessons
The gap this case illustrates is between a platform's security posture and a product's. Microsoft obsoleted BinaryFormatter, made it throw, removed it from .NET 9, and published guidance calling it unfixable. All of that applied to .NET, not to .NET Framework, and WSUS runs on .NET Framework 4.5. A deprecation that stops at a runtime boundary leaves the code on the other side of the boundary exactly as it was.
The patch sequence shows a second pattern: a fix that closes a flaw and a fix that removes a capability are different things. The October 14 update added the code path CODE WHITE identified as the sink; the October 23 update replaced it with a thrown exception. A deserialization sink guarded by a binder that only remaps assembly names is a sink, and the shortest route to correctness was deleting the call.
The CVE counts point at a third pattern, one that is only visible in hindsight. A component can be quiet because it is safe or quiet because nobody is looking, and the two are indistinguishable from the outside until something makes researchers look. Eighteen years of near-silence in the WSUS record did not mean eighteen years without bugs.
Finally, this case shows how quickly the technical record can fix on the wrong description. A CVE number typo in one widely-read writeup put a 2023 BinaryFormatter cookie bug under a 2025 CVE across most secondary coverage, including the original analyst note here. The operational guidance was unaffected, since the patch and the exposed ports are the same either way. Detection engineering written against the wrong endpoint would not have been.
References