Embed Notice

Since posting the thread, people are now using this vuln in the wild.

So far, people aren’t using it to hit downstream client PCs and servers. I’d urge defenders not to detail how to do this yet as ransomware operators basically don’t know yet, it gives orgs more time to patch.

There are a lot of WSUS servers on the internet and from sample scanning, I can’t find any that are patched.

https://www.huntress.com/blog/exploitation-of-windows-server-update-services-remote-code-execution-vulnerability