CVE-2025-59287 PoC — Windows Server Update Service (WSUS) Remote Code Execution Vulnerability

Source

https://github.com/0xBruno/WSUSploit.NET

Associated Vulnerability

Title:Windows Server Update Service (WSUS) Remote Code Execution Vulnerability (CVE-2025-59287)
Description:Deserialization of untrusted data in Windows Server Update Service allows an unauthorized attacker to execute code over a network.

Description

PoC for CVE-2025-59287

Readme

# WSUSploit.NET

C# PoC for CVE-2025-59287

Basically a port of the initial public PoC. Warning, will mess up WSUS.


## Disclaimer: 
This is for ethical and legal security testing, research, and education. Do not use any of this software in any unauthorized manner. 

## Defensive Considerations

These HTTP calls in this order. A more advanced threat actor may throw in random HTTP calls to avoid this detection.
IIS Log Path :`C:\inetpub\logs\LogFiles\<WSUS IIS SERVER>\<LOG FILE NAME>.log`
```
POST /ReportingWebService/ReportingWebService.asmx
POST /SimpleAuthWebService/SimpleAuth.asmx 
POST /ClientWebService/Client.asmx 
POST /ReportingWebService/ReportingWebService.asmx
```


Windows Event 7053 

Source: Windows Server Update Services

Windows Logs > Application
```
...
System.InvalidCastException -- Unable to cast object of type 'System.Windows.Data.ObjectDataProvider' to type 'System.Windows.Media.Brush'.
...
```

File Snapshot


 [4.0K]  /data/pocs/16ad3e9a7de5ae19bcdb2b25a15f0203a580b379
├── [ 15K]  Program.cs
├── [4.0K]  Properties
│   └── [ 154]  launchSettings.json
├── [ 929]  README.md
├── [ 291]  WSUSploit.NET.csproj
└── [1.1K]  WSUSploit.NET.sln

2 directories, 5 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →

Goal Reached Thanks to every supporter — we hit 100%!