CISA Says Ransomware Gangs Are Exploiting Windows Task Host Flaw
Summary
CISA says ransomware gangs are exploiting CVE-2025-60710, a Windows Task Host flaw that can let local attackers gain SYSTEM privileges. Microsoft has not publicly confirmed in-the-wild exploitation; the flaw was patched in November 2025.
Key points
- CVE-2025-60710 is a Windows Task Host privilege-escalation flaw affecting Windows 11 and Windows Server 2025.
- Successful exploitation by a local attacker with basic user permissions can provide SYSTEM privileges.
- The flaw stems from a link-following weakness and was patched by Microsoft in November 2025.
- CISA added the vulnerability to its Known Exploited Vulnerabilities catalog and says ransomware gangs are exploiting it.
- CISA did not provide details about attacks, and Microsoft has not publicly confirmed in-the-wild exploitation.
- CISA gave Federal Civilian Executive Branch agencies two weeks to secure their systems.
Article Details
- Vulnerability Types
- Privilege escalation
- Link following weakness
- Severity
- High
- Affected Versions
- Windows 11
- Windows Server 2025
- Exploitation Status
- active
- Exploit Availability
- unknown
- Patch Status
- available
- Workarounds
- Apply mitigations per vendor instructions; discontinue use of the product if mitigations are unavailable.
MITRE ATT&CK
CVE
Vendors
Products
Windows 11CISA confirmed that ransomware gangs are exploiting CVE-2025-60710, a high-severity Windows Task Host privilege escalation flaw affecting Windows 11 and Windows Server 2025.Windows Server 2025CISA confirmed that ransomware gangs are exploiting CVE-2025-60710, a high-severity Windows Task Host privilege escalation flaw affecting Windows 11 and Windows Server 2025.