Out of band update to WSUS. All server versions.

[sigma]

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-59287
 

This appears to be an update to the October cumulative update.

[robintech]

It says "The WSUS Server Role is not enabled by default on Windows servers. Windows servers that do not have the WSUS server role enabled are not vulnerable to this vulnerability" so if I'm checking with {Get-WindowsFeature -Name UpdateServices } against all servers to find any that need to be rebooted, rest of them I can patch and leave till tonight I think.

 

Display Name                                            Name                       Install State                     
------------                                            ----                       ------------- --------------                                      
[ ] Windows Server Update Services                      UpdateServices                 Available

[kennysarmy]

Am I right in thinking that if I've installed the November update on my WSUS server that I'm now protected from this vulnerability?

[sigma]

1 hour ago, kennysarmy said:

Am I right in thinking that if I've installed the November update on my WSUS server that I'm now protected from this vulnerability?

 

Yes.  the November update is Cumulative.