Loading story…
A critical remote code execution (RCE) vulnerability was discovered in Microsoft's Update Health Tools (KB4023057), a utility designed to facilitate rapid security updates via Intune. Researchers found that a misconfiguration involving abandoned Azure blob storage allowed attackers to register a storage account and receive requests from vulnerable devices worldwide, enabling arbitrary code execution. Microsoft has since responded to the disclosure, and newer versions of the tool have addressed the issue, but devices running the original version remain at risk if not updated.
Separately, a remote code execution vulnerability in Microsoft Windows Server Update Services (WSUS), tracked as CVE-2025-59287, was actively exploited by threat actors to deploy the ShadowPad backdoor malware. Attackers leveraged this flaw to gain system-level access using PowerCat and subsequently installed ShadowPad via certutil and curl. The exploitation of these vulnerabilities highlights the risks associated with update management tools and the importance of timely patching and secure configuration to prevent compromise by advanced persistent threats.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
EYE Security published research describing the Windows Update Health Tools remote code execution issue and how updates could be abused. The disclosure added public technical detail about the vulnerability and its exploitation path.
AhnLab ASEC published analysis of a ShadowPad intrusion that exploited CVE-2025-59287 through WSUS-related update infrastructure. This established real-world abuse of the vulnerability by a known malware threat.
A remote code execution vulnerability affecting Windows Update Health Tools and exploitable through WSUS was identified and tracked as CVE-2025-59287. The flaw enabled malicious code execution in enterprise update environments.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft released an urgent out-of-band security update to address a critical remote code execution vulnerability in Windows Server Update Services (WSUS), identified as CVE-2025-59287. The flaw was reportedly under active exploitation in the wild, prompting Microsoft to issue a comprehensive fix outside of its regular update cycle. Security advisories and industry news highlighted the severity of the vulnerability and its inclusion in the U.S. CISA Known Exploited Vulnerabilities catalog, underscoring the immediate risk to organizations relying on WSUS for patch management. The vulnerability allowed attackers to potentially execute arbitrary code on affected WSUS servers, posing a significant threat to enterprise environments. Security experts urged organizations to apply the patch without delay to mitigate the risk of compromise. The rapid response from Microsoft and the attention from security agencies reflect the critical nature of the flaw and the ongoing threat landscape targeting core infrastructure components like WSUS.
Jul 12, 2026
Microsoft released security updates addressing **79 vulnerabilities** across its product portfolio, including **19 remote code execution** flaws and several issues already under active exploitation. The most severe bug, **`CVE-2024-43491`**, is a **Windows Update** use-after-free vulnerability with a **CVSS 9.8** rating that can allow **unauthenticated remote code execution**. Critical vulnerabilities were also reported in **Microsoft SharePoint Server**, **Azure Web Apps**, **Azure Stack Hub**, and **Windows Network Address Translation**, expanding the risk beyond endpoint systems to server and cloud-connected environments. Microsoft and third-party reporting said attackers were already exploiting **`CVE-2024-38014`** in **Windows Installer**, **`CVE-2024-38217`** in **Mark of the Web**, **`CVE-2024-38226`** in **Microsoft Publisher**, and **`CVE-2024-43491`** in **Windows Update**. The updates were published through Microsoft’s Security Update Guide and release notes, including related Mariner release information, and organizations were urged to prioritize deployment because the exploited flaws span privilege escalation and remote code execution paths across multiple supported Windows versions and Microsoft products.
Jul 24, 2026
Microsoft Windows Server Update Services (WSUS) is affected by **CVE-2025-59287**, a critical unauthenticated remote code execution flaw with a **CVSS 9.8** score that is being actively exploited in the wild. The vulnerability stems from insecure deserialization of `AuthorizationCookie` objects handled by the `GetCookie()` endpoint, allowing a remote attacker to send crafted `POST` requests to WSUS servers exposed on ports `8530` and `8531` and execute arbitrary code as **SYSTEM**. Observed exploitation has involved WSUS-related processes such as `w3wp.exe` and `wsusservice.exe` spawning `cmd.exe` and `powershell.exe`, indicating full server compromise through the update management service. Microsoft has issued an emergency security update for affected WSUS deployments, while defenders have been urged to patch immediately, restart servers after applying fixes, and restrict inbound access to ports `8530` and `8531` or disable WSUS temporarily if patching cannot be completed at once.
Jul 24, 2026