The U.S. Cybersecurity and Infrastructure Security Agency (CISA) confirmed that ransomware gangs are exploiting the CVE-2025-60710 security vulnerability in the Windows Task Host component. The agency added the vulnerability on April 13 to its Known Exploited Vulnerabilities catalog, before updating the catalog again on Friday to explicitly indicate its association with attacks carried out by ransomware gangs.
The vulnerability affects Windows 11 and Windows Server 2025 devices and stems from a weakness in the link-following mechanism. Microsoft fixed the flaw in security updates released in November 2025. According to the vulnerability description, a local attacker with basic user privileges can exploit it to elevate their privileges to SYSTEM level, giving them full control over the unpatched device.
What Is the Role of Windows Task Host?
Task Host is a core Windows component that enables background execution of processes based on DLL files. It also helps the system close them properly during shutdown to reduce the risk of data corruption. Because exploiting the flaw requires the attacker to be present locally with an account possessing limited privileges, it is not necessarily the initial entry point into the network, but it may provide a critical privilege-escalation stage after the attacker gains access to a device.
What Changes in Practice?
CISA has not published details about the ongoing attacks or the entities that exploited CVE-2025-60710, and Microsoft had not updated its security advisory by the time of publication to confirm exploitation in real-world attacks. Nevertheless, adding the vulnerability to the Known Exploited Vulnerabilities catalog, followed by identifying its use by ransomware gangs, increases the priority of applying updates for organizations that are still using unpatched versions.
Microsoft said the vulnerability was addressed in the November 2025 update and that customers who installed the update are protected and do not need to take additional action. CISA, meanwhile, urged organizations to apply remediation measures according to the company’s instructions, comply with the guidance in Binding Operational Directive BOD 22-01 concerning cloud services, or discontinue use of the product if suitable mitigation measures cannot be provided.
A Broader Context of Microsoft Product Exploitation
The warning comes a week after CISA announced that ransomware gangs had begun exploiting a remote code execution vulnerability in Microsoft SharePoint, identified as CVE-2026-45659, following confirmation of its active exploitation in early July. Since November 2021, the agency has added 383 actively exploited vulnerabilities in Microsoft products to its catalog, including 112 vulnerabilities that were also used in ransomware attacks.
This means that addressing CVE-2025-60710 should not be understood as a measure separate from a vulnerability management program. The practical priority is to verify that the November 2025 update is installed on Windows 11 and Windows Server 2025 devices, then review systems that remained unpatched for indicators of compromise or unexpected local accounts. The article did not provide additional details about the indicators of compromise or the attack methods used.