The Digital Security Authority (DSA) wants to bring to your attention a vulnerability affecting Windows Server Update Service (WSUS). 

Technical Details

Deserialization of untrusted data in Windows Server Update Service allows an unauthorized attacker to execute code over a network.
A remote, unauthenticated attacker could send a crafted event that triggers unsafe object deserialization in a legacy serialization mechanism, resulting in remote code execution.

Recommendations

The Digital Security Authority recommends to perform the necessary mitigation steps that can be found in Microsoft site here.

References

1. Common Vulnerabilities & Exposures
2. Common Weakness Enumeration

The information presented in this report is based on available data up to the 05th of November 2025. 

 [ Get the report  in .PDF ]