Microsoft: Patch for WSUS flaw disabled Windows Server hotpatching

Microsoft released an out-of-band update (KB5070881) to address a critical, actively exploited RCE in WSUS (CVE-2025-59287), but that emergency patch broke hotpatch enrollment on some Windows Server 2025 systems; Microsoft withdrew the hotpatch-offering, published a corrected update (KB5070893) that preserves hotpatching, and advised remediation steps. The flaw has a public PoC, CISA added it to its catalog of abused flaws, and internet scanning groups report thousands of WSUS instances exposed, increasing exploitation risk.