Microsoft Releases KB5070881, KB5070879, KB5070884 for Critical Windows Server Vulnerability

Earlier this week, Microsoft rolled out an emergency update for Windows 11 (KB5070773) to fix a USB input bug in Windows Recovery. Now, the company is back with another emergency OOB update, which fixes a severe remote code execution (RCE) vulnerability across all supported versions of Windows Server.

The vulnerability, tracked as CVE-2025-59287, affects the Windows Server Update Services (WSUS) component. Microsoft explains that servers without the WSUS server role enabled are not exposed to this exploit.

RCE vulnerabilities are among the most serious because attackers can execute malicious code remotely without needing physical access to a device. To mitigate the issue, Microsoft has issued an out-of-band (OOB) cumulative update, its third emergency patch this month.

The company further noted that administrators do not need to install any prior updates before installing this one.

Affected Versions and Patch Details

• Windows Server 2025 (KB5070881)
• Windows Server, version 23H2 (KB5070879)
• Windows Server 2022 (KB5070884)
• Windows Server 2019 (KB5070883)
• Windows Server 2016 (KB5070882)
• Windows Server 2012 R2 (KB5070886)
• Windows Server 2012 (KB5070887)