The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has confirmed that ransomware groups are actively exploiting a high-severity privilege escalation vulnerability in Windows Task Host. This flaw, identified as CVE-2025-60710, was initially flagged by CISA as being actively exploited in April, and the agency recently updated its Known Exploited Vulnerabilities (KEV) Catalog to specifically note its abuse by ransomware gangs.
The vulnerability affects Windows 11 and Windows Server 2025 devices and stems from a link following weakness. Task Host is a fundamental Windows system component responsible for managing background DLL-based processes and ensuring their proper termination to prevent data corruption. Successful exploitation allows local attackers with basic user permissions to achieve SYSTEM privileges, granting them full control over unpatched systems.
Microsoft released a patch for CVE-2025-60710 in November 2025. Despite CISA's confirmation of in-the-wild exploitation, Microsoft has not yet updated its security advisory to reflect this activity. CISA added the vulnerability to its KEV Catalog on April 13, giving Federal Civilian Executive Branch (FCEB) agencies two weeks to apply the necessary security updates. The recent update to the KEV Catalog specifically highlights the involvement of ransomware groups in exploiting this flaw.
CISA has not disclosed specific details regarding the ongoing attacks or the ransomware groups involved. The agency consistently warns that such vulnerabilities are frequent targets for malicious actors and pose significant risks, particularly to federal systems. It advises organizations to apply vendor-provided mitigations, adhere to applicable BOD 22-01 guidance for cloud services, or discontinue use of affected products if mitigations are unavailable.
This development follows a similar warning from CISA a week prior, concerning a Microsoft SharePoint remote code execution vulnerability (CVE-2026-45659) that ransomware gangs also began exploiting after CISA confirmed active exploitation in early July. Since November 2021, CISA has identified 383 actively exploited vulnerabilities across various Microsoft products, with 112 of these also being leveraged in ransomware attacks.
