Notifications
Clear all
Topic starter
02/08/2026 12:15 pm
TL;DR: Researchers report that attackers are actively exploiting patched WSUS RCE CVE-2025-59287 to obtain SYSTEM-level access, run PowerCat, fetch additional tools with certutil and curl, and deploy ShadowPad through DLL sideloading, according to Anomali. The lesson is that high-privilege update infrastructure becomes a full compromise path when patching and access review lag behind exposure.
NHIMG editorial — based on content published by Anomali covering ShadowPad exploitation of a patched WSUS vulnerability
Questions worth separating out
Q: What breaks when attackers can exploit a patched WSUS server?
A: A patched-but-exposed WSUS server still breaks the trust model if the patch is not actually deployed everywhere.
Q: Why are update servers such attractive targets for attackers?
A: Update servers are attractive because they sit inside highly trusted administrative paths and can affect many endpoints from a single compromise.
Q: How do security teams know whether WSUS exploitation is progressing to full compromise?
A: Look for the sequence, not just one alert: remote shell activity, PowerCat usage, certutil or curl downloads, unexpected DLL sideloading, and service-like persistence.
Practitioner guidance
- Verify WSUS exposure and patch status immediately Confirm every WSUS server is patched against CVE-2025-59287 and remove or isolate any instance that cannot be validated.
- Harden administrative trust around update infrastructure Restrict who can reach WSUS, require strong authentication for admin workflows, and place update systems in tightly segmented management zones.
- Alert on shelling, staged retrieval, and DLL pairing patterns Search for PowerCat execution, certutil or curl fetching external files, and suspicious DLLs placed beside trusted executables such as ETDCtrlHelper.exe.
What's in the full analysis
Anomali's full post covers the operational detail this post intentionally leaves for the source:
- MITRE ATT&CK mapping for the ShadowPad intrusion chain, including the specific technique references used in the article
- The analyst's detection guidance for PowerCat, certutil, curl, and DLL sideloading behaviour on Windows servers
- The concise compromise narrative showing how WSUS exploitation progresses from initial execution to persistence
- The surrounding items in the Cyber Watch roundup, including password analysis, HashJack, FlexibleFerret, and Shai-Hulud 2.0
👉 Read Anomali's analysis of ShadowPad operators exploiting the WSUS RCE →
WSUS exploitation and ShadowPad: what defenders need to do now?
Explore further
02/08/2026 1:17 pm
Single-point patch failure becomes a privilege-domain failure. When attackers can use one missed WSUS patch to reach SYSTEM, the issue is no longer basic vulnerability hygiene. It is a control failure around privileged administrative infrastructure that sits upstream of software distribution and endpoint trust. The practical conclusion is that patch latency on update services creates outsized blast radius.
A few things that frame the scale:
- The average estimated time to remediate a leaked secret is 27 days, despite 75% of organisations expressing strong confidence in their secrets management capabilities, according to The State of Secrets in AppSec.
- Only 44% of developers are reported to follow security best practices for secrets management, exposing a significant developer behaviour gap.
A question worth separating out:
Q: Who is accountable when compromised access infrastructure keeps working after patching?
A: Accountability sits across platform owners, IAM teams, and security operations because patching alone does not remove persistence or confirm that access state has been cleaned up. Frameworks that matter here include least-privilege and configuration management controls, plus the operational responsibility to verify that no unauthorized access path survives remediation.
👉 Read our full editorial: WSUS patch failures can hand attackers SYSTEM-level control
