An updated version of the October 2025 Scan Cab is available
From Microsoft 365 Message Center Archive by Merill Fernando · Microsoft may not have sent this notice to your tenant.Microsoft asks admins to prevent or fix an issue. Read what it asks below and check the linked documentation; whether your tenant is affected is not known here.
What the notice says
Microsoft’s text, safely structuredIMPORTANT: This notice is only relevant for environments where:
- Scan Cab is used to check for update compliance.
- The October 2025 Scan Cab was deployed before 8:54 pm PT on October 24, 2025.
An updated version of the October 2025 Scan Cab was made available at 8:54 pm PT on October 24, 2025. This Scan Cab includes new metadata corresponding to new updates for the following versions of Windows Server:
- Windows Server 2025 (KB5070762; KB5070881)
- Windows Server, version 23H2 (KB5070879)
- Windows Server 2022 (KB5070884)
- Azure Automanage for Windows Server 2022 with Hotpatch (KB5070892)
- Windows Server 2019 (KB5070883)
- Windows Server 2016 (KB5070882)
- Windows Server 2012 R2 (KB5070886)
- Windows Server 2012 (KB5070887)
The new Microsoft updates include an out-of-band update, released October 20, 2025, to fix an issue in the Windows Recovery Environment (WinRE), and out-of-band updates, released October 23-24, 2025, that include additional protections to address CVE-2025-59287. Windows servers that do not have the WSUS server role enabled are not affected by this vulnerability. See the additional information section of this message for details.
How this affects your organization
IT administrators who downloaded the Scan Cab before 8:54 pm PT on October 24, 2025, should re-acquire and re-deploy their Scan Cab if it is used to assess updates for environments where Windows Server is installed and the WSUS server role is enabled.
No action is required on environments where Scan Cab is not employed. However, please note that there might be non-Microsoft applications which utilize Scan Cab. Review the documentation for any software and update deployment tools which might be in use for your organization to understand if this is applicable in your environment.
What you need to do to prepare
Administrators can re-deploy the updated Scan Cab via their usual processes. For detailed guidance, see the Additional information section below.
Additional information
- Updated Scan Cab: Download the new Scan Cab here
- CVE-2025-59287: Windows Server Update Service (WSUS) Remote Code Execution Vulnerability
- Announcing a smaller WSUS Scan Cab - Microsoft Tech Community: Learn more about WSUS and the Scan Cab process
- Using WUA to Scan for Updates Offline - Win32 apps | Microsoft Docs: Windows Update Agent (WUA) can be used to scan computers for security updates without connecting to Windows Update
- WSUS and the Catalog Site | Microsoft Docs: The Catalog Site used by WSUS to import updates and drivers
What changed
Between archive captures, newest firstThe archive supplies one version of this notice.
Learn more
Links from the notice and their documentation checks- KB5070762Not read yet
- KB5070881Not read yet
- KB5070879Not read yet
- KB5070884Not read yet
- KB5070892)Not read yet
- KB5070883Not read yet
- KB5070882Not read yet
- KB5070886Not read yet
- KB5070887Not read yet
- CVE-2025-59287
- Updated Scan Cab: Download the new Scan Cab here
- Announcing a smaller WSUS Scan Cab - Microsoft Tech CommunityNot read yet
- Using WUA to Scan for Updates Offline - Win32 apps | Microsoft DocsNot read yet
- WSUS and the Catalog Site | Microsoft DocsNot read yet
Related public evidence
No related evidence found in this installation's recent collection. This does not establish that no announcement exists.
Not confirmed here
What this page cannot tell you- Whether your tenant is affected: this is Microsoft's notice, not a check of your settings.
- 12 linked pages have not been read yet.