Port 8530 – WSUS HTTP

TCP

Port 8530 is the WSUS (Windows Server Update Services) HTTP port for distributing Windows updates within an organization. Domain-joined machines download updates from the internal WSUS server on port 8530 instead of from Microsoft directly. Use port 8531 (HTTPS) for encrypted update delivery and certificate pinning.

Port Number

8530

Protocol

TCP

Service

Windows Server Update Services HTTP

Range

IANA Registered (1024–49151)

Description

WSUS on port 8530 serves Windows updates to enterprise clients from a centralized internal server. Instead of each machine downloading updates from Microsoft's CDN, a WSUS server downloads updates once and distributes them locally – saving internet bandwidth and enabling update approval workflows. WSUS on port 8530 (HTTP) transmits update metadata and binaries without encryption. An attacker on the local network could theoretically intercept and modify update content (WSUS abuse attacks). Use port 8531 (HTTPS) with a valid internal CA certificate and configure clients via Group Policy to require SSL. WSUS also requires IIS with specific ASP.NET and authentication module configurations.

Security risks

1CVE-2020-1013 (CVSS 7.5): Windows Update elevation of privilege – WSUS clients using HTTP (port 8530) can be tricked into installing attacker-supplied updates by MITM on the local network. The 'WSUS attack' technique injects malicious updates signed with a self-signed certificate that the client accepts when HTTPS is not enforced.
2WSUXploit/WSUSPendu attacks: published tools demonstrate injecting arbitrary .exe updates into WSUS HTTP streams. A rogue machine on the same network intercepts WSUS traffic on port 8530, modifies the update metadata, and delivers malware disguised as a legitimate Microsoft patch. All domain-joined machines in the WSUS group receive the payload.
3PyWSUS exploitation framework: pen-testing tool that creates a fake WSUS server, ARP-spoofs the network, and serves malicious updates to clients configured for HTTP WSUS (port 8530). One compromised update = SYSTEM-level code execution on every patching client.
4Metadata tampering: WSUS on port 8530 transmits update approval lists, computer group memberships, and reporting data in cleartext. An attacker can decline security updates for specific machines (leaving them unpatched) without detection.
5Privilege escalation chain: WSUS client runs as SYSTEM. If the update source (port 8530) is compromised, the attacker achieves SYSTEM on every client machine that checks in – often hundreds or thousands of domain-joined workstations.

Firewall guidance

Migrate WSUS from HTTP (8530) to HTTPS (8531) immediately – this single change prevents all known WSUS interception attacks. In IIS: bind an internal CA certificate to the WSUS website on port 8531. In Group Policy: set 'Specify intranet Microsoft update service location' to https://wsus.domain.com:8531. Then block port 8530 in Windows Firewall. Only domain-joined machines on the corporate network should reach port 8531.

Diagnosis commands

Check if WSUS URL uses HTTP (8530) or HTTPS (8531) – HTTP = vulnerable

shell

reg query "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate" /v WUServer

Test WSUS HTTP connectivity (should be migrated to 8531)

shell

curl -I http://wsus-server:8530/ClientWebService/client.asmx

PowerShell: verify WSUS server port and SSL status

shell

Get-WsusServer | Select-Object Name,PortNumber,IsSSL

Verify TLS certificate is bound to WSUS HTTPS port

shell

netsh http show sslcert ipport=0.0.0.0:8531

Usage examples

Port 8530 – WSUS HTTP

shell

wuauclt /detectnow /reportnow
Get-WsusUpdate -Approval Unapproved
GPO: Set intranet update service: http://wsus:8530

Common services on this port

Windows Server Update Services (WSUS)System Center Configuration Manager (SCCM/MECM)Windows Update for Business

Related ports

8531

WSUS HTTPS (encrypted – use this)

Windows Update (Microsoft CDN fallback)

443

Windows Update (Microsoft CDN HTTPS)

History

WSUS was introduced with Windows Server 2003 SP1 (2005) as a free alternative to SMS/SCCM for patch management. Port 8530 (HTTP) and 8531 (HTTPS) were chosen because 80/443 were typically occupied by other IIS sites. The 'WSUS attack' was first demonstrated at BlackHat 2015 by Paul Stone and Alex Chapman, showing that HTTP WSUS allows arbitrary code execution via fake updates. Despite being known for nearly a decade, many organizations still use HTTP WSUS because the HTTPS migration requires certificate infrastructure and GPO changes.

FAQ

How do I migrate WSUS from port 8530 to 8531 (HTTPS)?

Steps: (1) Obtain an internal CA certificate for the WSUS server hostname. (2) In IIS Manager, bind the cert to the WSUS Administration site on port 8531. (3) In the WSUS console: Server Options > Update Source > Require SSL (check the box). (4) Run: WsusUtil.exe configuressl wsus.domain.com. (5) Update Group Policy: Computer Config > Admin Templates > Windows Update > Specify intranet update service = https://wsus.domain.com:8531. (6) Force gpupdate on clients and verify in Windows Update logs.

Is WSUS still needed with Windows Update for Business?

Windows Update for Business (WUfB) delivers updates directly from Microsoft CDN over HTTPS – eliminating the local WSUS server and its attack surface entirely. WUfB is recommended for organizations that don't need: update approval workflows, offline/air-gapped networks, or bandwidth optimization via local caching. WSUS remains necessary for: disconnected environments, compliance requiring pre-approval, and SCCM-integrated patching.