Incident Response Checklist

🚨 Immediate Actions (0-24 hours)

Disable WSUS service on affected servers immediately.
Block inbound traffic on ports 8530 and 8531 at the network perimeter.
Notify relevant stakeholders about the critical vulnerability and potential impact.
Apply the out-of-band security update from Microsoft on all affected servers.

🔄 Recovery Actions

Apply the comprehensive patch from Microsoft to all WSUS servers.
Re-enable WSUS services only after confirming patches are applied and no threats remain.
Conduct a thorough review of server configurations and security settings.
Restore any affected systems from clean backups if necessary.