A critical Windows Server Update Services (WSUS) remote code execution (RCE) vulnerability is under active exploitation following the public release of proof-of-concept code. The flaw, tracked as CVE-2025-59287 (CVSS 9.8/10), is caused by unsafe deserialization of untrusted AuthorizationCookie objects using BinaryFormatter in a legacy serialization mechanism, allowing unauthenticated attackers to execute arbitrary code with SYSTEM privileges on Windows servers with the WSUS Server Role enabled. Microsoft initially addressed the issue during Patch Tuesday but later re-released out-of-band patches (KB5070881, and KB5070887) to fully mitigate it across all supported Windows Server versions. Successful exploitation enables attackers to remotely execute PowerShell and cmd.exe commands, download and run Base64-encoded payloads, and enumerate network and domain information (whoami, net user/domain, ipconfig/all) before exfiltrating data to attacker-controlled webhooks. Threat activity was first observed between October 23 – 24, 2025, by Eye Security, Huntress, and the Dutch National Cyber Security Centre (NCSC-NL), with over 2,500 WSUS servers found publicly exposed (some within high-value environments). Given the vulnerability’s wormable potential and active exploitation, organizations are strongly urged to apply Microsoft’s out-of-band patches immediately or, if patching is not possible, to disable the WSUS Server Role and block inbound ports 8530 and 8531. The U.S. Cybersecurity and Infrastructure Security (CISA) has added CVE-2025-59287 to its Known Exploited Vulnerabilities (KEV) catalog, mandating federal remediation by no later than November 14, 2025. CTIX analysts strongly urge administrators to ensure that all vulnerable systems are patched before the deadline.