CISA’s confirmation that CVE-2025-60710 is now being exploited by ransomware groups significantly changes how organisations should treat this Windows Task Host vulnerability. The flaw is not a remote-code-execution bug that allows an attacker to compromise a machine directly from the Internet. Instead, it is a local privilege-escalation vulnerability in the Host Process for Windows Tasks, caused by improper link resolution before file access. An attacker who already has basic local access can exploit the flaw to elevate privileges to SYSTEM and take full control of an unpatched Windows device. Microsoft rates the vulnerability CVSS 7.8, and the affected products include Windows 11 24H2, Windows 11 25H2 and Windows Server 2025.

This distinction is important because ransomware attacks are rarely based on one vulnerability alone. Initial access may come from phishing, stolen credentials, exposed remote-access services, malicious downloads or exploitation of another application. Once attackers obtain a low-privilege foothold, they need a way to become administrator or SYSTEM. CVE-2025-60710 provides exactly that transition. It effectively turns an ordinary compromised user account into a much more powerful position from which attackers may disable security tools, dump credentials, tamper with backups, deploy persistence and prepare ransomware execution. CISA originally added the vulnerability to its Known Exploited Vulnerabilities catalog on April 13, 2026, and has now further flagged it as being used specifically in ransomware activity.

The technical weakness is classified as CWE-59, improper link resolution before file access, commonly referred to as link following. In simplified terms, an application performs a file operation while trusting a filesystem path or link that an attacker can influence. By manipulating symbolic links, junctions or related filesystem redirection mechanisms, an attacker may be able to cause a privileged Windows process to access or modify a location different from the one originally intended. When the vulnerable operation executes with higher privileges, the attacker can potentially use that behaviour to cross the boundary between a normal user and SYSTEM.

What makes this vulnerability valuable to ransomware operators is that exploitation requires low privileges but no user interaction once the attacker is already present on the system. The CVSS vector is AV:L/AC:L/PR:L/UI:N, meaning the attack is local, has low complexity, requires only low privileges and does not require the victim to click anything during the privilege-escalation stage. From an attacker's perspective, that makes CVE-2025-60710 a useful post-compromise tool. Initial access remains the difficult part; after that, privilege escalation can potentially be automated as part of an intrusion framework.

The affected operating systems also deserve attention. The vulnerability impacts relatively recent Microsoft platforms, including Windows 11 24H2, Windows 11 25H2 and Windows Server 2025. This is a useful reminder that running a modern operating system does not automatically mean the system is secure. Security ultimately depends on whether the relevant updates have actually been deployed. The flaw was patched by Microsoft in November 2025, so organisations that still remain vulnerable months later are dealing with a patch-management gap rather than the absence of a vendor fix.

Customer protection should therefore begin with patch verification, not merely patch policy. Organisations should identify all Windows 11 24H2, Windows 11 25H2 and Windows Server 2025 systems and verify that the security updates addressing CVE-2025-60710 have actually been installed. CISA’s required action for federal agencies is to apply vendor mitigations or discontinue use where mitigation is unavailable. For enterprises outside the federal environment, KEV inclusion should still be treated as a strong prioritisation signal because it confirms real-world exploitation rather than theoretical exploitability.

Patching alone, however, is not sufficient protection against ransomware. Because CVE-2025-60710 is a privilege-escalation vulnerability, an attacker must already have obtained some level of access. Customers therefore need to focus equally on preventing that initial foothold. Strong email security, phishing protection, endpoint protection, controlled software execution, MFA for remote access, protection of VPN and RDP services, credential hygiene and rapid remediation of externally exposed vulnerabilities remain essential. Blocking the privilege-escalation step while leaving easy initial-access paths available merely forces the attacker to choose another escalation technique.

Endpoint detection is particularly important for this type of vulnerability. Security teams should monitor for suspicious manipulation of symbolic links, NTFS junctions, reparse points and unexpected filesystem objects created shortly before privileged processes perform file operations. They should also investigate unusual child processes or command shells launched from Windows system components, unexpected SYSTEM-level processes, abnormal service creation, scheduled tasks, credential-dumping behaviour and security-tool tampering. The exact exploit chain used by current ransomware groups has not been publicly detailed by CISA, so defenders should focus on behavioural indicators of privilege escalation rather than depending exclusively on one static exploit signature.

Application control can provide another useful layer. Technologies such as Windows Defender Application Control or properly configured application allow-listing can restrict the execution of unapproved binaries and scripts after an attacker gains access. This will not directly remove the vulnerability, but it can reduce what the attacker is able to execute before and after privilege escalation. Similarly, PowerShell logging, command-line auditing and endpoint telemetry should be enabled so that attempts to move from low privilege to SYSTEM do not disappear into the enormous amount of perfectly ordinary Windows background activity, a design choice that has kept incident responders employed for decades.

Customers should also review local administrator privileges. Users should not routinely operate with administrative rights, and administrative credentials should be separated from normal user accounts. This does not completely stop CVE-2025-60710 because the flaw is specifically designed to elevate a low-privilege user, but least privilege still reduces the attack surface and limits alternative routes attackers could use if the exploit fails. Local administrator passwords should be unique and centrally managed, for example through Windows LAPS, to prevent one compromised endpoint from immediately providing credentials that work across the rest of the network.

Network segmentation remains critical once ransomware enters the environment. A compromised workstation should not automatically be able to communicate with domain controllers, backup servers, hypervisors, database systems and every server subnet. Privilege escalation on one endpoint becomes far more dangerous when that endpoint also enjoys unrestricted east-west connectivity. Segmentation between user networks, server environments, management infrastructure and backup systems can substantially limit the attacker's ability to turn SYSTEM access on one device into enterprise-wide ransomware.

Backup architecture is equally important because ransomware groups increasingly target backups before encryption. Backup systems should use separate credentials, restricted management interfaces, immutability or offline copies where feasible, and network isolation from ordinary user endpoints. An attacker who gains SYSTEM privileges on a workstation should not automatically have a network path or reusable credential that allows deletion of backup repositories. Recovery procedures should also be tested, because discovering during an incident that the backup exists but cannot actually be restored is among the industry's less amusing traditions.

From a firewall and network-security perspective, customers should not expect a network appliance alone to block CVE-2025-60710 because the actual privilege escalation occurs locally after compromise. The firewall's role is instead to reduce the probability of initial access and restrict what happens afterward. IPS and threat-prevention controls can block known exploit traffic associated with initial compromise vectors, application controls can restrict risky services, URL filtering and anti-malware can reduce malicious payload delivery, and segmentation policies can prevent a compromised endpoint from freely moving toward critical assets.

Outbound monitoring also becomes valuable after privilege escalation. Ransomware operators often need command-and-control access, credential exfiltration, remote tooling or infrastructure for staging stolen information. Organisations should monitor unusual outbound connections, connections to newly registered or low-reputation domains, abnormal DNS activity, unexpected encrypted traffic from endpoints and large outbound data transfers. Increasingly, ransomware incidents involve data theft before encryption, so stopping exfiltration can be almost as important as stopping the final ransomware payload.

Customers should also consider threat-hunting across systems that remained unpatched after April 13, 2026, when CISA first confirmed active exploitation. Merely installing the November 2025 patch today does not demonstrate that a previously vulnerable machine was never compromised. Systems exposed during the known exploitation period should be reviewed for suspicious privilege changes, newly created services, scheduled tasks, persistence mechanisms, endpoint-protection exclusions, unusual administrative accounts and evidence of credential access. Patch management answers whether the vulnerability exists now; threat hunting answers whether somebody used it while it existed.

The broader lesson from CVE-2025-60710 is that ransomware defence cannot be reduced to detecting the ransomware executable at the final stage of an attack. By the time files begin being encrypted, attackers may already have spent hours or days obtaining access, escalating privileges, stealing credentials, mapping the network, disabling controls and attacking backups. CVE-2025-60710 belongs to that earlier and extremely important privilege-escalation phase.

Customers should therefore approach this vulnerability using a layered response: patch affected Windows systems immediately, verify rather than assume deployment, restrict initial-access vectors, enforce MFA and least privilege, monitor endpoints for privilege-escalation behaviour, segment critical infrastructure, protect administrative credentials, isolate backups and investigate systems that were vulnerable during the active-exploitation period. The objective should not simply be to stop one CVE. It should be to prevent a low-privilege compromise from becoming SYSTEM access, and prevent SYSTEM access on one machine from becoming ransomware across the organisation.

CISA's latest update is an important reminder that a CVSS 7.8 privilege-escalation vulnerability can be operationally more dangerous than a higher-scoring vulnerability that attackers are not actually using. Once ransomware groups incorporate a flaw into their attack chains, vulnerability prioritisation should change accordingly. The relevant question is no longer only "How severe is this vulnerability?" It is "Are attackers using it to move from an initial foothold toward complete control?" For CVE-2025-60710, CISA's answer is now clearly yes.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has confirmed that ransomware gangs are also exploiting a high-severity Windows Task Host vulnerability that was flagged as actively exploited in April. [...]

Source: CISA: Windows Task Host flaw now exploited by ransomware gangs via Bleeping Computer — published 18 Aug 2026.