CVE-2025-60710: Windows Task Host link following privilege escalation

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: medium.

high priorityCVSS 7.8 with confirmed KEV listing and known ransomware use, but exploitation requires local low-privileged access rather than remote reach.

What it is

The Host Process for Windows Tasks resolves links improperly before accessing files (CWE-59), letting a local attacker redirect file operations to attacker-controlled targets. Microsoft rates it 7.8 HIGH, and CISA added it to KEV with known ransomware campaign use, so it is being exploited in the wild.

Impact

An authorized local attacker gains elevation of privileges, with high impact to confidentiality, integrity and availability of the affected system. In ransomware chains this class of bug is typically used to move from a low-privileged foothold to SYSTEM-level control.

Attack surface

Reached locally (AV:L) with low attack complexity and no user interaction; the attacker needs only low privileges (PR:L) on the host. No network vector or remote unauthenticated path is described.

Exploitation

Listed in CISA KEV (added 2026-04-13, due 2026-04-27) with known ransomware campaign use, and EPSS 30-day probability 0.04598 (91st percentile). No public exploit code or specific ransomware group is named in the record.

What to do

• Apply the Microsoft update for CVE-2025-60710 on Windows 11 24H2, Windows 11 25H2 and Windows Server 2025; treat as urgent per KEV due date 2026-04-27.
• If patching cannot be completed immediately, apply the vendor mitigations or the third-party mitigation script referenced in the advisory, or discontinue use of the affected product per BOD 22-01 guidance.
• Restrict and monitor local interactive logon and privilege assignment so low-privileged users cannot readily trigger task host file operations.
• Harden file and directory permissions on paths used by the Windows Task Host to reduce link-following redirection opportunities.
• Track KEV remediation status and confirm patched builds across all affected Windows 11 and Server 2025 endpoints.

Detection

• Monitor for suspicious file or link creation in directories accessed by the Windows Task Host process, especially reparse points and symlinks.
• Alert on task host processes spawning or accessing unexpected executables or system paths outside normal behavior.
• Correlate local privilege escalation indicators (token or process integrity changes) with task host activity on the same host.
• Hunt for known post-exploitation and ransomware precursor behavior on hosts running unpatched Windows 11 24H2/25H2 or Server 2025.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.