{"uuid": "df263956-4291-438f-895d-ab81ac011065", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-59287", "type": "exploited", "source": "https://t.me/hacking_Attack/174245", "content": "Weekly Purple Team Episode: CVE-2025-59287 - Exploiting & Detecting the Critical WSUS RCE\nhttps://www.reddit.com/r/redteamsec/comments/1oq0q6o/weekly_purple_team_episode_cve202559287/\n\nI've just released a new episode covering CVE-2025-59287, the unauthenticated WSUS RCE (CVSS 9.8) that has been actively exploited in the wild since late October. For those who haven't been tracking this issue: it's an unsafe deserialization flaw in Windows Server Update Services that allows remote attackers to execute SYSTEM-level code without authentication. CISA added it to the KEV catalog within 24 hours of confirmed exploitation, and we've seen everything from reconnaissance to infostealer deployment (Skuld) to pre-ransomware activity. \ud83d\udd34 Red Team Perspective:\n How easy this is to exploit.\n pre-built scripts for exploitation\n How the exploit works in detail.  \ud83d\udd35 Blue Team Perspective:\n Building robust detection rules for exploitation indicators\n Process telemetry analysis (wsusservice.exe \u2192 cmd.exe \u2192 powershell.exe)\n SIEM/EDR strategies for catching post-exploitation activity\n Many of the Sigma rules and writeups are incorrect on this one. Have a look. The goal is to show both how the attack works AND how to build detections that catch it - understanding the red side makes you better at blue.    submitted by    /u/Infosecsamurai  (https://www.reddit.com/user/Infosecsamurai) \n [link] (https://youtu.be/GKp9hnysMOE)   [comments] (https://www.reddit.com/r/redteamsec/comments/1oq0q6o/weekly_purple_team_episode_cve202559287/)", "creation_timestamp": "2026-09-03T03:00:06.590143Z"}