CISA orders federal agencies to patch Windows Server WSUS flaw exploited in attacks

The Cybersecurity and Infrastructure Security Agency (CISA) has issued an urgent directive to all federal agencies to patch a critical vulnerability in Windows Server Update Services (WSUS). This flaw has been actively exploited by threat actors, posing significant risks to government networks and sensitive data. The vulnerability allows attackers to execute arbitrary code remotely, potentially leading to full system compromise. CISA's emergency directive underscores the severity of the issue and the need for immediate remediation to prevent further exploitation. Federal agencies are advised to prioritize patch deployment and verify the integrity of their WSUS servers to mitigate ongoing threats. This incident highlights the persistent challenges in securing legacy infrastructure components and the importance of proactive vulnerability management. Organizations using WSUS should also review their security posture and apply the necessary updates to safeguard against similar attacks. The coordinated response from CISA aims to strengthen the federal cybersecurity defense and protect critical digital assets from malicious actors exploiting this WSUS flaw.

This Cyber News was published on www.bleepingcomputer.com. Publication date: Mon, 27 Oct 2025 13:30:36 +0000


Cyber News related to CISA orders federal agencies to patch Windows Server WSUS flaw exploited in attacks

CISA adds Check Point Quantum Security Gateways and Linux Kernel flaws to its Known Exploited Vulnerabilities catalog - CISA adds Apache Flink flaw to its Known Exploited Vulnerabilities catalog. CISA adds D-Link DIR router flaws to its Known Exploited Vulnerabilities catalog. CISA adds Google Chrome zero-days to its Known Exploited Vulnerabilities catalog. CISA adds ...
1 year ago Securityaffairs.com
CISA orders federal agencies to patch Windows Server WSUS flaw exploited in attacks - The Cybersecurity and Infrastructure Security Agency (CISA) has issued an urgent directive to all federal agencies to patch a critical vulnerability in Windows Server Update Services (WSUS). This flaw has been actively exploited by threat actors, ...
1 month ago Bleepingcomputer.com CVE-2024-27512
CISA Issues Warning on WSUS Vulnerability Exploited by Threat Actors - The Cybersecurity and Infrastructure Security Agency (CISA) has issued a critical warning regarding a newly discovered vulnerability in Windows Server Update Services (WSUS). This vulnerability has been actively exploited by threat actors to gain ...
4 weeks ago Cybersecuritynews.com CVE-2024-27512 UNC2447
Microsoft confirms Windows Server Update Services (WSUS) sync is broken - "Devices trying to synchronize updates from Microsoft Updates using Windows Server for Update Services (WSUS) might fail to complete the synchronization process. Microsoft has confirmed a widespread issue in Windows Server Update Services (WSUS) that ...
4 months ago Bleepingcomputer.com
Actively Exploited WSUS Bug Added to CISA Known Exploited Vulnerabilities Catalog - A critical vulnerability in Microsoft's Windows Server Update Services (WSUS) has been actively exploited in the wild, prompting the Cybersecurity and Infrastructure Security Agency (CISA) to add it to its Known Exploited Vulnerabilities Catalog. ...
1 month ago Infosecurity-magazine.com CVE-2024-27512
Microsoft patch for WSUS flaw disabled Windows Server hotpatching - Microsoft recently released a patch to address a critical flaw in Windows Server Update Services (WSUS). However, this patch inadvertently disabled the hotpatching feature on Windows Server, causing operational challenges for system administrators. ...
3 weeks ago Bleepingcomputer.com
Accelerating Safe and Secure AI Adoption with ATO for AI: stackArmor Comments on OMB AI Memo - We appreciate the opportunity to comment on the proposed Memo on Agency Use of Artificial Intelligence. Ensuring agencies have access to adequate IT infrastructure,. We base our remarks on our experience helping US Federal agencies transform their ...
1 year ago Securityboulevard.com
CISA orders federal agencies to patch Looney Tunables Linux bug - Today, CISA ordered U.S. federal agencies to secure their systems against an actively exploited vulnerability that lets attackers gain root privileges on many major Linux distributions. Dubbed 'Looney Tunables' by Qualys' Threat Research Unit and ...
1 year ago Bleepingcomputer.com CVE-2023-4911 CVE-2023-46604
Majority of Gao's Cybersecurity Recommendations Not Implemented by Federal Agencies - The Government Accountability Office has recently reported that federal agencies have been slow to implement a majority of the recommendations it made for improving the cybersecurity of federal agencies. Despite the implementation progress at some ...
2 years ago Securityweek.com
PoC WSUS RCE Vulnerability - A critical Remote Code Execution (RCE) vulnerability has been discovered in Microsoft's Windows Server Update Services (WSUS). This flaw allows attackers to execute arbitrary code on affected systems, potentially leading to full system compromise. ...
1 month ago Cybersecuritynews.com CVE-2024-27512
Security Alert! CISA Reports Refund Scam Targeting Federal Agencies Through Remote Management Software - The Cybersecurity and Infrastructure Security Agency (CISA) recently issued an alert to federal agencies about a refund scam targeting them through remote management software. According to the alert, hackers have been using the remote software to ...
2 years ago Therecord.media
Microsoft delays WSUS driver sync deprecation indefinitely - One month later, Microsoft reminded admins to prepare for WSUS driver sync deprecation, encouraging them to adopt cloud-based solutions for client and server updates, like Windows Autopatch, Microsoft Intune, and Azure Update Manager. Introduced ...
7 months ago Bleepingcomputer.com
CISA Seeks Public Comment on Newly Developed Secure Configuration Baselines for Google Workspace - As federal civilian agencies continue to modernize IT enterprises, increased reliance on cloud services, platform services, and external providers has introduced new types of risks. Recent threat activity from groups such as Storm-0558 have ...
1 year ago Cisa.gov Cuba
CISA warns of actively exploited Juniper pre-auth RCE exploit chain - CISA warned federal agencies today to secure Juniper devices on their networks by Friday against four vulnerabilities now used in remote code execution attacks as part of a pre-auth exploit chain. The alert comes one week after Juniper updated its ...
1 year ago Bleepingcomputer.com
High-severity flaw affects Cisco Firepower Management Center - CISA adds GitLab flaw to its Known Exploited Vulnerabilities catalog. CISA adds Cisco ASA and FTD and CrushFTP VFS flaws to its Known Exploited Vulnerabilities catalog. Critical Fortinet's FortiClient EMS flaw actively exploited in the wild. Hackers ...
1 year ago Securityaffairs.com CVE-2020-3259 CVE-2024-23897 CVE-2024-0204 CVE-2023-20198 CVE-2023-38831 Rocke
High-severity flaw affects Cisco Firepower Management Center - CISA adds GitLab flaw to its Known Exploited Vulnerabilities catalog. CISA adds Cisco ASA and FTD and CrushFTP VFS flaws to its Known Exploited Vulnerabilities catalog. Critical Fortinet's FortiClient EMS flaw actively exploited in the wild. Hackers ...
1 year ago Securityaffairs.com CVE-2020-3259 CVE-2024-23897 CVE-2024-0204 CVE-2023-20198 CVE-2023-38831 Rocke
15 Best Patch Management Tools - 2025 - What is Good?What Could Be Better?Comprehensive patch management for various operating systems, applications, and third-party software.It is complex for new users and requires time and training to utilize its functionalities fully.Advanced analytics ...
8 months ago Cybersecuritynews.com
WSUS vulnerability: CISA issues late Friday warning - Microsoft's Windows Server Update Services (WSUS) has a critical vulnerability that has prompted a late Friday warning from the Cybersecurity and Infrastructure Security Agency (CISA). This vulnerability could allow attackers to execute remote code, ...
1 month ago Therecord.media CVE-2024-27512
Critical unauthenticated RCE flaw in OpenSSH server - MUST READ. Critical unauthenticated remote code execution flaw in OpenSSH server. Expert released PoC exploit code for Veeam Backup Enterprise Manager flaw CVE-2024-29849. CISA adds Oracle WebLogic Server flaw to its Known Exploited Vulnerabilities ...
1 year ago Securityaffairs.com CVE-2024-29849 CVE-2023-49103 CVE-2023-20198 CVE-2023-38831 Rocke
CISA pushes federal agencies to patch Citrix RCE within a week - Today, CISA ordered U.S. federal agencies to secure their systems against three recently patched Citrix NetScaler and Google Chrome zero-days actively exploited in attacks, pushing for a Citrix RCE bug to be patched within a week. Citrix urged ...
1 year ago Bleepingcomputer.com CVE-2023-6548 CVE-2023-6549 CVE-2024-0519
CISA orders agencies to immediately patch Citrix Bleed 2, saying bug poses ‘unacceptable risk’ | The Record from Recorded Future News - The bug affects Citrix Netscaler ADC and Netscaler Gateway appliances and the company said exploitation of the vulnerability “on unmitigated appliances have been observed.” Since that advisory, multiple incident responders have warned that the ...
4 months ago Therecord.media CVE-2025-5777
CISA Directs Federal Agencies to Immediately Mitigate Significant Risk From Russian State-Sponsored Cyber Threat - WASHINGTON - Today, the Cybersecurity and Infrastructure Security Agency publicly issued Emergency Directive 24-02 in response to a recent campaign by Russian state-sponsored cyber actor Midnight Blizzard targeting Microsoft corporate email accounts ...
1 year ago Cisa.gov
CISA pledges to resolve issues with threat sharing system after watchdog report - On Friday, the Department of Homeland Security’s Office of the Inspector General published a report on Automated Indicator Sharing (AIS) — which was used to spread cyber threat intelligence and was mandated as part of a 2015 law. The nation’s ...
1 year ago Therecord.media
Critical Apache Log4j2 flaw still threatens global finance - Critical Apache Log4j2 flaw still threatens global finance. CISA adds Apache Flink flaw to its Known Exploited Vulnerabilities catalog. CISA adds GitLab flaw to its Known Exploited Vulnerabilities catalog. Russia-linked APT28 used post-compromise ...
1 year ago Securityaffairs.com CVE-2022-38028 CVE-2023-49103 CVE-2023-20198 CVE-2023-40044 APT28 Rocke
How Cloud Solutions Can Lead to Stronger, More Secure IT Operations - Cloud services, which offer tools such as networks, servers, and data storage, can help federal agencies deliver better IT services while minimizing costs. Without adequate security measures, these services can expose agencies to cyberattacks. The ...
1 year ago Cyberdefensemagazine.com