InfoSecBulletin Cybersecurity for mankind
Bangladesh cyber security watchdog BGD e-GOV CIRT published an advisory (27.10.2025) regarding critical romote code execution vulnarability in Microsoft WSUS CVSS score 9.8 as per NVD, NIST.
CIRT has detected a serious security flaw in Microsoft’s WSUS that could let an attacker fully control a WSUS server. This vulnerability not only impacts the server but could also enable the attacker to send harmful updates, compromise devices, and gain significant access to our network. It considers this a high-priority incident and urge immediate patching or mitigation for all WSUS servers. Inaction could result in regulatory, operational, and reputational harm.
FortiSandbox, FortiOS, FortiProxy ZTNA flaws unveil, while Fortigate firewall actively exploited
Microsoft Patch Tuesday September 2026 Fixed 973 Flaws Fixed, 2 Zero-Days
A single call: ShinyHunters Gained Access to 6 Million Customers’ Records
The first zero-click worm to spread through WeChat calls across iOS and Android
USA Bimbo Bakeries Confirms Data Stolen in Oracle EBS Zero-Day Attack
ALERT
Roundcube Webmail fixes 12 security flaws, including zero-click XSS and SSRF bypass
New HOOKEDGE Backdoor Deployed by Hackers in European Espionage
Hackers Exploiting MikroTik RouterOS Flaw Gaining Network Access
CrowdStrike launches SafeMind, the first agentic cybersecurity solution for defenders
Claude, DeepSeek, and Qwen AI agents combinedly used to hit gov.t across Asia
Vulnerability Summary:
The critical remote code execution (RCE) vulnerability has been identified in Microsoft WSUS. The flaw stems from deserialization of untrusted data in WSUS reporting web services and allows an unauthenticated attacker to send specially crafted requests to a WSUS server (with the WSUS Server Role enabled) and execute arbitrary code as NT AUTHORITY\SYSTEM. The issue has been assigned a CVSS 3.x score of 9.8 (per NVD/NIST) and is listed in CISA’s Known Exploited Vulnerabilities catalog.
Affected Systems & Scope:
Only Windows servers with the WSUS role enabled are affected. Servers without WSUS aren’t vulnerable. Commonly exposed ports for WSUS are TCP 8530 (HTTP) and TCP 8531 (HTTPS); servers on these ports may be at higher risk.
All Windows Server versions with WSUS enabled are vulnerable unless patched. Vendors provide specific KBs for each OS version. Although WSUS usually operates internally, the risk remains high if a WSUS server is accessible.
Impact:
• Successful exploitation grants the attacker remote code execution with SYSTEM privileges on the WSUS server. This means full compromise of that server.
If compromised, the attacker could use the WSUS server to move laterally, distribute harmful updates, gain higher privileges, or deploy additional payloads.
As WSUS is a patch-distribution infrastructure, compromise may undermine trust in the update process or allow poisoning of updates.
IOCs:
Recomendations:
The Cyber Incident Response Team (CIRT) has advised immediate actions to address the critical WSUS vulnerability. Within 24–72 hours, inventory all WSUS servers to assess their exposure, checking if they are accessible internally or externally and if TCP ports 8530 and 8531 are open. Administrators should install the out-of-band security update from Microsoft dated 23 October 2025 and reboot the servers to apply it. If patching cannot be done right away, temporarily disable the WSUS Server Role or block traffic to ports 8530 and 8531 at the host and network firewall to avoid exploitation.
