ShadowPad Malware Actively Exploits WSUS Vulnerability for Full System Access

🗓️ 24 Nov 2025 07:18:00Reported by The Hacker NewsType

thn

thn🔗 thehackernews.com👁 12 Views

ShadowPad exploits WSUS vulnerability for initial access and installs backdoor via certutil and curl.

Reporter	Title	Published	Views	Family All 114
GithubExploit	Exploit for Deserialization of Untrusted Data in Microsoft	9 Mar 202607:43	–	githubexploit
GithubExploit	Exploit for Deserialization of Untrusted Data in Microsoft	28 Oct 202519:56	–	githubexploit
GithubExploit	Exploit for Deserialization of Untrusted Data in Microsoft	1 Nov 202520:05	–	githubexploit
GithubExploit	Exploit for Deserialization of Untrusted Data in Microsoft	6 Nov 202510:56	–	githubexploit
GithubExploit	Exploit for Deserialization of Untrusted Data in Microsoft	26 Dec 202507:22	–	githubexploit
GithubExploit	Exploit for Deserialization of Untrusted Data in Microsoft	9 Jan 202610:52	–	githubexploit
GithubExploit	Exploit for Deserialization of Untrusted Data in Microsoft	3 Nov 202510:51	–	githubexploit
GithubExploit	Exploit for Deserialization of Untrusted Data in Microsoft	27 Oct 202514:05	–	githubexploit
GithubExploit	Exploit for Deserialization of Untrusted Data in Microsoft	26 Dec 202507:22	–	githubexploit
GithubExploit	Exploit for CVE-2025-59287	27 Oct 202510:08	–	githubexploit

30 Nov 2025 09:05Current

9High risk

Vulners AI Score9

CVSS 3.19.8

EPSS0.99962

ShadowPad malware Windows Update Services ShadowPad backdoor Initial access Remote code execution Certutil curl usage