The 3rd party patches are stored locally on the SCCM server then distributed to WSUS and update sites by WSUS processes. Since the ADR is attempting to download from a local source (WSUS), a configuration issue is most likely causing this issue or the cab file creating during publishing is missing.
- When you installed the WSUS role on the SCCM server did you specify the content path as a local drive like C:\? A path like \servername will most likely fail. (this setting would be in IIS)
- Can you confirm if the the cab file exists in the content folder on your WSUS server? If it does not, your issue is likely that the signing certificate is not in the proper stores on the WSUS server. It should be in Trusted Root and Trusted publishers. The softwaredistribution log on the WSUS server should confirm if this is the issue. If this is the issue new updates you publish will work.
- If the cab file does exist and you are using a proxy then we have a proxy issue where the account running the ADR is not hitting the WSUS server. This can happen if you configured the proxy settings in Config manager and you need to bypass local.