WSUS CVE-2026-50328

Exploitation requires network reachability to a running WSUS server instance on an affected Windows Server (2012 through 2025) - the WSUS role must be installed and its client/management listener (default TCP 8530/8531) reachable from the attacker. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), no special conditions beyond that: remote unauthenticated exploitation with low complexity and no user interaction against default configurations of WSUS. Limiting factors: the target host must actually run the WSUS server role (not present on default Windows Server installs), and network segmentation restricting WSUS ports to trusted management subnets substantially narrows who can reach the vulnerable service; impact is confined to availability (service crash), with no confidentiality or integrity effect indicated by the vector.

The CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H yields 7.5 (High), driven entirely by availability impact - an attacker can crash the service with low complexity, no privileges, and no user interaction, with no confidentiality or integrity loss per the vector. There is a data conflict worth flagging: the description characterizes the impact as 'tampering' and the tags include 'Authentication Bypass,' yet the CVSS vector sets I:N and grants no privileges (PR:N, A:H only). This points to a denial-of-service rather than tampering or auth bypass; verify the true impact against the Microsoft advisory before treating it as an integrity issue. No EPSS score, KEV entry, POC, or SSVC data was provided, so exploitation likelihood cannot be quantified. Practically, the ease of exploitation (network, unauthenticated, low complexity) makes this a meaningful availability risk for reachable WSUS servers, but the absence of confidentiality/integrity impact and any evidence of active exploitation places it below RCE-class emergencies.

An attacker with network reachability to a WSUS server sends a crafted request to its client- or management-facing endpoint that triggers the unhandled exception, terminating the WSUS service and halting update distribution to all managed clients. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N, no credentials, user interaction, or complex setup are required, and repeated requests could sustain the outage. No public exploit identified at time of analysis.