CVE report
CVE-2025-59287criticalKEV
Windows Server Update Service - Insecure Deserialization
Events 90d
852
Distinct IPs
262
Severity
critical
CISA KEV
Actively exploited
Detection signature
An event counts toward CVE-2025-59287 when its URL path contains any of these (case-insensitive). This is what our matching is based on.
- · /SimpleAuthWebService/SimpleAuth.asmx
- · /ClientWebService/Client.asmx
- · /ReportingWebService/ReportingWebService.asmx
Pre-disclosure activity
all early actors →Analysing probe history around the publication date…
Recent probe volume (last 7 days)
peak: 21 events/dayeventsdistinct IPs
Downloads & integrations
Top sources probing for CVE-2025-59287
- 65.49.1.13221 eventsUnited States
- 65.49.1.18218 eventsUnited States
- 65.49.1.14216 eventsUnited States
- 74.82.47.316 eventsUnited States
- 65.49.1.2416 eventsUnited States
- 65.49.1.1015 eventsUnited States
- 64.62.156.19215 eventsUnited States
- 216.218.206.6714 eventsUnited States
- 65.49.20.6713 eventsUnited States
- 64.62.156.3813 eventsUnited States
- 216.218.206.6613 eventsUnited States
- 65.49.20.6913 eventsUnited States
- 184.105.139.6713 eventsUnited States
- 65.49.1.3812 eventsUnited States
- 64.62.156.20212 eventsUnited States
- 64.62.156.10812 eventsUnited States
- 74.82.47.512 eventsUnited States
- 65.49.20.6812 eventsUnited States
- 65.49.1.8012 eventsUnited States
- 64.62.156.9411 eventsUnited States
- 64.62.156.2411 eventsUnited States
- 65.49.1.9411 eventsUnited States
- 64.62.156.8011 eventsUnited States
- 74.82.47.411 eventsUnited States
- 74.82.47.211 eventsUnited States
- 65.49.20.6611 eventsUnited States
- 65.49.1.17210 eventsUnited States
- 65.49.1.23210 eventsUnited States
- 64.62.156.14210 eventsUnited States
- 64.62.156.12210 eventsUnited States
Top networks the attempts come from
Fingerprints of the clients exploiting this
The HTTP (JA4H) and TLS (JA4) fingerprints seen on these attempts. Click one to see the whole population that carries it.
Sample request paths observed
- /ClientWebService/Client.asmx?wsdl
- /ClientWebService/Client.asmx?singleWsdl
- /SimpleAuthWebService/SimpleAuth.asmx
- /ClientWebService/Client.asmx
- /ReportingWebService/ReportingWebService.asmx