Alert Status: Critical
The Department of Information and Communications Technology (DICT), through the National Cyber Security Center (NCSC), issues this alert to all PNG Government departments, agencies, large organisations, and network infrastructure teams about a critical vulnerability discovered in Microsoft Windows Server Update Service (WSUS).
Background
The identified vulnerability is tracked as CVE-2025-59287. If successfully exploited, this vulnerability could allow an unauthenticated attacker to execute arbitrary code on the affected WSUS server with system privileges. This would grant the attacker full control over the server, enabling them to distribute malicious updates to all endpoints connected to it, compromising the confidentiality, integrity, and availability of the entire organizational network.
The vulnerability affects Microsoft Windows Server Update Service in Windows Server (2012, 2016, 2019, 2022 and 2025). Organizations utilizing WSUS are strongly urged to review their systems immediately.
Mitigations
NCSC strongly recommends taking the following actions:
1. Review Systems: All PNG Government departments, agencies, and organizations are urged to conduct an immediate review of their networks to identify any instances of Microsoft Windows Server Update Service (WSUS) and refer to the Microsoft Security Update Guide for mitigation.
Prompt action is crucial in addressing this critical vulnerability to ensure the security and stability of your organization’s systems and data. By remaining vigilant and keeping your infrastructure up-to-date, you can effectively safeguard against this and other potential cyber threats.
The NCSC and the Department of ICT are dedicated to promoting a secure digital environment, and we encourage all stakeholders to adhere to the recommended actions for enhanced cybersecurity resilience.
For any further assistance or inquiries, please reach out to the National Cyber Security Center (NCSC). Together, let us prioritize cybersecurity and protect Papua New Guinea’s digital landscape.