Loading story…
Microsoft confirmed a Windows Server Update Services (WSUS) issue that caused synchronization delays, scan failures, and timeouts, preventing some organizations from deploying recent Windows updates through WSUS or Configuration Manager. The problem affects client systems running Windows 10 version 1607 and later and server systems running Windows Server 2012 and later, with broader impact reported from July 13 as publishing metadata accumulated and disrupted normal update synchronization.
Microsoft said a service-side mitigation restored normal behavior for newly installed or rebuilt WSUS servers, but existing deployments could remain affected. The company then published manual remediation guidance for administrators, including backing up SUSDB, running a cleanup query to remove problematic metadata, and restoring MaxXMLPerRequest to its default value; administrators on forums such as r/sysadmin reported stalled client reporting and approved updates failing to reach hundreds of endpoints until fixes were applied.
See real exploitation activity before you spend the cycle.
4 events from the most recent confirmed update back to the earliest known activity.
Microsoft later released manual mitigation steps for existing WSUS servers still affected by sync delays and timeouts. The guidance included backing up SUSDB, running a cleanup query to remove problematic metadata, and restoring MaxXMLPerRequest to its default value.
On July 19, Microsoft deployed a mitigation that restored normal synchronization behavior for newly installed or rebuilt WSUS servers. Existing affected WSUS environments could still continue to experience synchronization problems after this change.
Microsoft said it deployed a service-side mitigation on July 18, 2026 that restored normal synchronization behavior for newly installed or rebuilt WSUS servers and prevented those systems from encountering the issue. The company attributed the degradation to a buildup of mis-published test detectoids in the WSUS channel.
Microsoft said the Windows Server Update Services synchronization problem saw heightened impact beginning July 13, 2026. The issue affected Windows 10 version 1607 and later and Windows Server 2012 and later, causing synchronization slowdowns or timeouts that blocked some update deployments through WSUS or Configuration Manager.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
6 references tracked. Mallory keeps watching after this page renders.
securityonline.info
Open sourcereddit.com
Open sourcebleepingcomputer.com
Open sourcereddit.com
Open sourcebleepingcomputer.com
Open sourcesupport.microsoft.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft said it has fixed a known issue that caused some **Windows Server 2019** and **Windows Server 2022** systems to upgrade automatically to **Windows Server 2025** without administrator approval. The company confirmed the resolution in a Windows release health update and re-enabled the Windows Server 2025 upgrade offer in the Windows Update settings panel, allowing organizations to resume supported in-place upgrades through normal settings workflows. The issue was first acknowledged after administrators reported servers being upgraded overnight, in some cases to versions their organizations were not licensed to use. Microsoft had previously suggested that some cases involved misconfigured third-party update management tools, but update vendors disputed that explanation and said the problem stemmed from Microsoft's release speed or update classification process. The fix closes a problem that had persisted since 2024 and affected enterprise patching and change-control expectations for Windows Server environments.
Jun 29, 2026
Microsoft Windows Server Update Services (WSUS) is affected by **CVE-2025-59287**, a critical unauthenticated remote code execution flaw with a **CVSS 9.8** score that is being actively exploited in the wild. The vulnerability stems from insecure deserialization of `AuthorizationCookie` objects handled by the `GetCookie()` endpoint, allowing a remote attacker to send crafted `POST` requests to WSUS servers exposed on ports `8530` and `8531` and execute arbitrary code as **SYSTEM**. Observed exploitation has involved WSUS-related processes such as `w3wp.exe` and `wsusservice.exe` spawning `cmd.exe` and `powershell.exe`, indicating full server compromise through the update management service. Microsoft has issued an emergency security update for affected WSUS deployments, while defenders have been urged to patch immediately, restart servers after applying fixes, and restrict inbound access to ports `8530` and `8531` or disable WSUS temporarily if patching cannot be completed at once.
Aug 31, 2026
Microsoft released an urgent out-of-band security update to address a critical remote code execution vulnerability in Windows Server Update Services (WSUS), identified as CVE-2025-59287. The flaw was reportedly under active exploitation in the wild, prompting Microsoft to issue a comprehensive fix outside of its regular update cycle. Security advisories and industry news highlighted the severity of the vulnerability and its inclusion in the U.S. CISA Known Exploited Vulnerabilities catalog, underscoring the immediate risk to organizations relying on WSUS for patch management. The vulnerability allowed attackers to potentially execute arbitrary code on affected WSUS servers, posing a significant threat to enterprise environments. Security experts urged organizations to apply the patch without delay to mitigate the risk of compromise. The rapid response from Microsoft and the attention from security agencies reflect the critical nature of the flaw and the ongoing threat landscape targeting core infrastructure components like WSUS.
Jul 12, 2026