Main Vulnerability Database Vulnerabilities #VU117222

Deserialization of Untrusted Data in Windows Server - CVE-2025-59287

Published: October 15, 2025 / Updated: February 27, 2026

Vulnerability identifier: #VU117222

CSH Severity: Critical

CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2025-59287

CWE-ID: CWE-502

Exploitation vector: Remote access

Exploit availability: The vulnerability is being exploited in the wild

Vulnerability details

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to insecure input validation when processing serialized data. A remote attacker send a crafted event that triggers unsafe object deserialization in a legacy serialization mechanism and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Affected software

Windows Server

How to mitigate CVE-2025-59287

Install updates from vendor's website.

Windows Server - addressed in versions 2012 R2 6.3.9600.22824, 2012 6.2.9200.25722, 2016 10.0.14393.8519, 2019 10.0.17763.7919, 2022 23H2 10.0.25398.1913, 2022 10.0.20348.4294, 2025 10.0.26100.6899

Links to Public Exploits and PoC-codes

External References

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2025-59287

Related Security Bulletins

Remote code execution in Windows Server Update Service (WSUS)