Full Report
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has confirmed that ransomware gangs are also exploiting a high-severity Windows Task Host vulnerability that was flagged as actively exploited in April. [...]
Analysis Summary
# Vulnerability: Windows Task Host Local Privilege Escalation
## CVE Details
- **CVE ID:** CVE-2025-60710
- **CVSS Score:** 7.8 (High) - *Note: Based on typical CVSS metrics for high-severity Local Privilege Escalation.*
- **CWE:** CWE-59 (Improper Link Resolution Before File Action - "Link Following")
## Affected Systems
- **Products:** Microsoft Windows
- **Versions:**
- Windows 11
- Windows Server 2025
- **Configurations:** Systems where the Windows Task Host (taskhostw.exe) component is active.
## Vulnerability Description
CVE-2025-60710 is a privilege escalation vulnerability in the Windows Task Host, a core component responsible for running DLL-based processes and managing their closure during shutdown. The flaw is rooted in a "link following" weakness. An attacker can exploit how the service handles file paths or symbolic links to redirect a file operation performed by a SYSTEM-level process to a target of the attacker's choosing. This allows a local user with standard privileges to execute code or manipulate files with elevated SYSTEM permissions.
## Exploitation
- **Status:** Actively exploited in the wild (Confirmed by CISA; utilized by ransomware gangs).
- **Complexity:** Low
- **Attack Vector:** Local (Requires authenticated access to the target machine).
## Impact
- **Confidentiality:** High (Full access to system data).
- **Integrity:** High (Ability to modify system files and configurations).
- **Availability:** High (Ability to crash the system or delete critical files).
## Remediation
### Patches
- Microsoft released security updates for this vulnerability during the **November 2025 Patch Tuesday** cycle. Administrators should ensure systems are updated to the latest build of Windows 11 or Windows Server 2025.
### Workarounds
- No specific official workarounds have been provided other than applying the security updates. CISA recommends discontinuing use of the product if patches cannot be applied (though this is rarely feasible for core OS components).
## Detection
- **Indicators of Compromise:** Monitor for unusual child processes spawned by `taskhostw.exe` that possess SYSTEM privileges, especially those initiating network connections or file encryption activities.
- **Detection methods and tools:**
- Audit symbolic link creation by non-administrative users.
- Utilize EDR (Endpoint Detection and Response) tools to flag unauthorized privilege transitions from standard user to SYSTEM.
- Check CISA’s Known Exploited Vulnerabilities (KEV) Catalog for updated guidance.
## References
- CISA Known Exploited Vulnerabilities Catalog: [https[:]//www.cisa.gov/known-exploited-vulnerabilities-catalog]
- Microsoft Security Response Center (MSRC) Advisory: [http[:]//msrc.microsoft.com/update-guide/vulnerability/CVE-2025-60710]
- BleepingComputer Article: [https[:]//www.bleepingcomputer.com/news/security/cisa-windows-task-host-flaw-now-exploited-by-ransomware-gangs/]