Crisis Management for a Conflict with North Korea

Express Tribune | English | News | Nov. 14, 2025 | Cyber Attacks and Data Loss

Pakistan's national cyber-incident response team, PKCERT, has issued a critical advisory about a high-risk vulnerability in Microsoft Windows Server Update Services (WSUS), widely used by organizations for patch management across Windows networks. The flaw involves unsafe deserialization of the WSUS Authorization Cookie, allowing attackers to inject malicious code and remotely execute commands on the server without needing authentication.

This vulnerability enables remote code execution (RCE), meaning an attacker can take full control of the compromised WSUS server from anywhere, potentially distributing infected updates to thousands of connected machines. This can lead to widespread malware or ransomware infections, data theft, and full system control across both public and private sector networks. PKCERT rates the threat at 9.8 on the Common Vulnerability Scoring System, highlighting its critical severity.

To mitigate the risk, PKCERT recommends applying Microsoft's October 2025 out-of-band security patch, temporarily blocking vulnerable internet ports, and enhancing server security measures such as preventing WSUS servers from being exposed to the public internet. Organizations are also urged to monitor for suspicious activity and unauthorized access to maintain cybersecurity integrity.