Threat Research

    Monitors for instances where command-line interpreters like cmd.exe or powershell.exe are spawned as child processes of the WSUS service (wsusservice.exe). This behavior strongly indicates potential exploitation of a critical remote code execution vulnerability, such as CVE-2025-59287, where attackers may launch shells to perform reconnaissance or additional malicious actions....
    In October 2025, a critical remote code execution (RCE) vulnerability in Microsoft Windows Server Update Services (WSUS), tracked as CVE-2025-59287 (CVSS 9.8), was discovered. The flaw allows unauthenticated remote attackers to execute code with system-level privileges on affected servers....
    Looking for Something?
    Threat Research Categories:
    Tags