The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has recently added two high‑severity vulnerabilities — one in Microsoft Windows Server Update Services (WSUS) and another in Adobe Commerce/Magento Open Source — to its Known Exploited Vulnerabilities (KEV) Catalog due to confirmed active exploitation by threat actors.
WSUS Critical Vulnerability (CVE‑2025‑59287)
This is a remote code execution (RCE) flaw in Microsoft WSUS discovered by researchers at CODE WHITE GmbH. The vulnerability stems from unsafe deserialization of AuthorizationCookie objects in the WSUS API, allowing attackers to execute arbitrary code with SYSTEM‑level privileges.
- CVSS score: 9.8 (Critical)
- Affected systems:
- Windows Server 2012/2012 R2 (pre‑patched builds)
- Windows Server 2016, 2019, 2022, and 2025 (pre‑patched builds)
- Threat status: Exploitation confirmed; proof‑of‑concept code publicly released
- CISA directive: Federal agencies must patch by November 14, 2025 per BOD 22‑01.
In active attacks, adversaries are abusing deserialization weaknesses via the WSUS GetCookie() endpoint to gain control of update servers and potentially distribute malicious updates to downstream systems.
Magento / Adobe Commerce Vulnerability (CVE‑2025‑54236)
This improper input validation flaw, nicknamed SessionReaper, affects Magento and Adobe Commerce REST API implementations.
- CVSS score: 9.1 (Critical)
- Impact: Allows unauthorized takeover of customer accounts through crafted API requests.
- Exploitation details:
- Reported by researcher Blaklis and patched by Adobe.
- Security firm Sansec observed over 250 attacks within 24 hours, often deploying PHP webshells or
phpinfoprobes. - Only ~38% of Magento stores have applied the patch to date.
CISA Mitigation Mandate
Under CISA’s Binding Operational Directive 22‑01, both CVE‑2025‑59287 and CVE‑2025‑54236 have mandatory remediation deadlines of November 14, 2025 for all federal agencies. Organizations across public and private sectors are strongly urged to review their environments and patch immediately to prevent compromise.
