CVE-2025-60710

This flaw is like a trusted “task runner” in Windows that checks a file path, but can be tricked into opening the wrong (malicious) file. If an attacker already has a low level of access on your PC or server and can tamper with files in a watched folder/path, they can push the task runner to execute code with higher privileges. That makes it much easier for ransomware crews to take over machines and do more damage.

This matters if your business uses Windows 11 PCs or Windows Server 2025 servers. The attack is local and requires an attacker to already have low-privileged credentials on the target machine, plus the ability to place or modify files in a location watched by the Host Process for Windows Tasks service. In other words, it’s a serious risk mainly when a foothold exists and the attacker can reach those watched file locations (the vulnerability is reachable in default configuration).

This is RED because confirmed ransomware gangs are exploiting CVE-2025-60710 in real attacks. That means you should assume active compromise attempts are already underway, and patching is the immediate priority for affected machines. CISA’s KEV entry also gives a clear remediation deadline of 2026-04-27.

Confirm whether you’re exposed

• Identify all endpoints and servers running Windows 11 and Windows Server 2025.
• For each, capture the exact OS build/version (so you can compare to the fixed builds below).

Upgrade to the fixed builds (priority)

• Upgrade Windows to one of the Microsoft-fixed versions:
  • Windows 11: fixed in 10.0.26100.7462 and 10.0.26200.7462
  • Windows Server 2025: fixed in 10.0.26100.7462
  • Also listed: 10.0.26100.7392 / 10.0.26200.7392 (where applicable per your servicing channel)
• Use Microsoft’s update guidance for CVE-2025-60710 to ensure you’re applying the correct update for your build.

If patching is delayed (temporary risk reduction)

• Reduce the attacker’s ability to tamper with the files/locations that the Host Process for Windows Tasks service watches.
• Follow Microsoft’s vendor mitigation guidance for CVE-2025-60710 (and any organization-specific controls).

After upgrading

• Re-check the OS build to confirm the device is truly running the fixed version.
• Watch for suspicious task/host behavior and signs of privilege escalation attempts originating from low-privileged contexts.

Deadlines / governance

• This is listed in CISA KEV, with a remediation due date of 2026-04-27.

CVE-2025-60710 is a local elevation of privilege vulnerability (CWE-59, improper link resolution before file access) in the Host Process for Windows Tasks. An authenticated attacker with low privileges can exploit how the task host resolves file links to have it open/run attacker-controlled content that masquerades as legitimate files. The weakness enables executing code as a more privileged user without requiring additional user interaction.

KEV: The vulnerability is listed in CISA KEV as being used in ransomware campaigns, with CISA confirming active exploitation; that makes this an active, high-consequence threat.

Patch: Microsoft provides fixed builds for Windows 11 and Windows Server 2025 (notably 10.0.26100.7462 and 10.0.26200.7462, and also 10.0.26100.7392 / 10.0.26200.7392 where applicable).

Exploit code: No public exploit code was found in the provided findings, but that does not reduce risk because exploitation is confirmed in the wild.