Windows Task Host

CISA: Ransomware Gangs Exploit Windows Task Host Vulnerability to Escalate Privileges

CISA confirmed that ransomware gangs are exploiting a high-severity vulnerability in the Windows Task Host component after adding it in April to its Known Exploited Vulnerabilities catalog. Microsoft fixed the vulnerability in November 2025, but unpatched devices remain exposed to full attacker control.