IMPORTANT: This notice is only relevant for environments where:
- Windows Server Update Services (WSUS) is used to deploy Windows security updates to Windows Server devices.
- Scan Cab is used to check for update compliance.
- The October 2025 Scan Cab was deployed before 8:54 PM PT on October 24, 2025.
An updated version of the October 2025 Scan Cab was made available at 8:54 am PT on October 24, 2025. This Scan Cab includes new metadata corresponding to new updates for the following versions of Windows Server:
• Windows Server, version 23H2 (KB5070879)
• Windows Server 2022 (KB5070884)
• Azure Automanage for Windows Server 2022 with Hotpatch (KB5070892)
• Windows Server 2019 (KB5070883)
• Windows Server 2016 (KB5070882)
• Windows Server 2012 R2 (KB5070886)
• Windows Server 2012 (KB5070887)
The new Microsoft updates for these Windows Server versions, released October 24, 2025, included additional protections to address CVE-2025-59287. See the additional information section of this message for details.
How this affects your organization:
IT administrators who downloaded the Scan Cab before 8:54 PM PT on October 24, 2025, should re-acquire and re-deploy it if the Scan Cab is used to assess updates for environments where WSUS is used to deploy Windows security updates to Windows Server devices.
No action is required on environments where Scan Cab is not employed and does not use WSUS to Windows Server devices. However, please note that there might be non-Microsoft applications which utilize Scan Cab. Review the documentation for any software and update deployment tools which might be in use for your organization, to understand if this is applicable in your environment.
What you need to do to prepare:
Administrators can re-deploy the updated Scan Cab via their usual processes. For detailed guidance, see the Additional Information section below.
Additional information:
- Updated Scan Cab: Download the new Scan Cab here
- Take Action: Out-of-band update to address a vulnerability in Windows Server Update Services (WSUS)
- Windows Server Update Service (WSUS) Remote Code Execution Vulnerability
- Announcing a smaller WSUS Scan Cab - Microsoft Tech Community: Learn more about WSUS and the Scan Cab process
- Using WUA to Scan for Updates Offline - Win32 apps | Microsoft Docs: Windows Update Agent (WUA) can be used to scan computers for security updates without connecting to Windows Update
- WSUS and the Catalog Site | Microsoft Docs: The Catalog Site used by WSUS to import updates and drivers