CISA orders feds to patch actively exploited Windows Server WSUS flaw

**Executive summary:** CISA ordered U.S. federal agencies to urgently patch CVE-2025-59287, a critical, potentially wormable WSUS remote code execution vulnerability actively exploited in the wild (proof-of-concept released, scanning/exploitation observed), prompting Microsoft out-of-band updates and recommendations to disable the WSUS Server role if patches cannot be immediately applied.