Vulnerability

Philips lists PIC iX and Focal Point under exploited WSUS flaw CVE-2025-59287

MedDevice Cyber Staff · Oct 27 · 2 min read · Via Philips product security advisories 2025

On October 27, 2025, Philips posted a notice on CVE-2025-59287, a critical remote code execution vulnerability in Windows Server Update Service (WSUS) on Windows Server 2012, 2016, 2019, 2022 and 2025. The flaw is actively exploited. The listed products are Advanced Visualization Workspace (V15), PIC iX (C.x, 4.x) and Focal Point.

WSUS is the server that tells other Windows machines what to install. Remote code on that server is a path to every client it serves. Hospitals that run a WSUS role near clinical systems should check whether the role is even needed there.

Are you a representative of Philips? Submit an official response →

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

Apply the Microsoft fix for CVE-2025-59287 to any WSUS server associated with Advanced Visualization Workspace 15, PIC iX or Focal Point through Philips service. Block inbound WSUS ports from untrusted networks now.

Find WSUS roles. Identify Windows Servers running WSUS in or near the listed product environments.
Block the ports. Restrict inbound WSUS traffic to the clients that need it.
Patch through Philips. Apply the validated update for CVE-2025-59287 on each listed product.
Check for compromise. Review WSUS servers for unexpected child processes since the flaw is exploited.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the signals and properties below. Check them against your product to gauge exposure.

Required

Named operating system Wired network

Contributing

Field-updatable firmware Hospital network

Fix the class in your product

The flaw is in the OS inside the controller, or a system past end of service still in the field. As the maker, own the embedded OS and server lifecycle as a safety obligation, design controllers to update in the field, and make every fault degrade to a defined safe state.

Own the OS lifecycle. Patch the OS and server components on a schedule with a tested delivery path.
Design for field update. And for planned replacement, so an unpatchable unit has a path off the network.
Degrade to safe. A fault drives a defined safe state, never an unexpected stop on a life-sustaining device.

Mapped EMB3D mitigations

Products potentially also affected

Products whose own public documentation shares this advisory's attributes. A shared attribute is a lead, not a finding. The status column shows only what each manufacturer has said.

Product	Manufacturer	Shared with this advisory	Manufacturer status
Infinity Gateway Suite	Dräger	Same named componentWindows Server (2012, 2016, 2019, 2022 and 2025)	No feedback feed from manufacturer
Harmony Referral System	Topcon Healthcare	Same named componentWindows Server (2012, 2016, 2019, 2022 and 2025)	No feedback feed from manufacturer

Questions & Answers

What is CVE-2025-59287?

CVE-2025-59287 is a critical, actively exploited remote code execution flaw in Windows Server Update Service on Windows Server 2012 to 2025. Philips listed Advanced Visualization Workspace 15, PIC iX (C.x, 4.x) and Focal Point on October 27, 2025.

Is Philips PIC iX affected by the WSUS vulnerability?

Philips listed PIC iX versions C.x and 4.x in its October 27, 2025 notice on CVE-2025-59287, the WSUS remote code execution flaw.

← Back to Vulnerabilities