Two of the tools organizations use specifically to manage patching and endpoints at scale both had critical vulnerabilities of their own confirmed exploited: Windows Server Update Services (WSUS) and Microsoft Configuration Manager.
CVE-2025-59287, CVSS 9.8, is a deserialization vulnerability in WSUS, added to CISA's KEV catalogue on 24 October 2025. CVE-2024-43468, also CVSS 9.8, is a SQL injection vulnerability in Configuration Manager, added 12 February 2026.
The irony worth naming directly
WSUS exists to distribute patches. Configuration Manager exists to manage and deploy software, including patches, across an enterprise's endpoint fleet. Both are, by design, positioned with elevated trust and broad reach across every machine they manage — WSUS clients trust update packages their WSUS server serves them, and Configuration Manager agents execute whatever the management console instructs. A critical, unauthenticated vulnerability in either tool doesn't just compromise one server; it potentially hands an attacker a distribution channel that every managed endpoint already trusts implicitly.
This is the same structural risk seen throughout this year's KEV additions for management-plane software generally — a firewall management console, an SD-WAN orchestrator, a source-code platform — but WSUS and Configuration Manager sit at an even more privileged point in that hierarchy: they are the mechanism by which trust and code execution are legitimately distributed to an entire fleet as a matter of routine operation.
Why deserialization specifically is the recurring failure mode
WSUS's vulnerability is deserialization of untrusted data — the same vulnerability class behind some of the highest-severity, most consequential remote-code-execution bugs discussed throughout this year, including the TeamCity CI/CD vulnerability that made KEV in August. The pattern repeats because deserialization bugs share a structural property: the dangerous code execution happens during the act of reconstructing an object from attacker-supplied data, before any application-level validation can run. A patch-distribution service, receiving and processing data over a network as its core function, is an entirely typical place for this bug class to surface.
What to check this week
Patch WSUS and Configuration Manager with the same or greater urgency you'd apply to any endpoint they manage. The trust relationship runs in both directions: these tools are not exempt from vulnerability management just because they're part of your vulnerability management infrastructure.
Review WSUS and Configuration Manager server placement and network exposure. Neither tool should be broadly reachable beyond the specific endpoints and administrators that legitimately need to interact with it — an unauthenticated deserialization bug's real-world risk is defined heavily by what can actually reach the vulnerable service.
Audit recent patch and software deployment activity pushed through these systems for the exposure window, given that a compromised update-distribution service is a documented technique for achieving broad, trusted code execution across a managed fleet — the same logic that makes supply chain compromise of any trusted distribution channel so damaging.
Treat any anomalous package or update that was distributed through these systems as a priority investigation item, since endpoints receiving it would have executed it with the same trust as a legitimate update.
A broader lesson for any centralized management tool
The specific pairing here — a patch server and an endpoint configuration manager — generalizes to any centralized IT tool holding elevated, fleet-wide trust: a mobile device management platform, a group policy system, a remote scripting tool. Each represents the same underlying risk shape, and each deserves the same standard applied here: patch it at least as urgently as the systems it exists to secure, not on a slower cycle justified by its own operational importance.
A closing note on the audit trail
Organizations should specifically confirm their WSUS and Configuration Manager deployment logs are being retained and reviewed for the exposure window, since these two systems' own logs are what would show whether an unusual package or update was distributed through them during the relevant period.
One more note before closing
Smaller organizations running WSUS without a dedicated infrastructure team are the population most likely to defer patching this specific service, precisely because it doesn't run any user-facing application — worth flagging explicitly to whoever owns that system.
How Safeguard helps
Safeguard's continuous inventory and software supply chain visibility extend to the management and patch-distribution infrastructure organizations depend on to secure everything else, recognizing that a compromise of the distribution mechanism itself undermines the trust the rest of the fleet places in it — precisely the scenario these two CVEs make concrete.
