CVE-2025-60710 is a local privilege-escalation flaw in the Host Process for Windows Tasks (taskhostw.exe) that ransomware operators are now exploiting to gain SYSTEM on patched-but-unpatched Windows 11 and Server 2025 machines. It carries a CVSS score of 7.8, is listed in CISA's Known Exploited Vulnerabilities catalog with a ransomware-use flag of "Known," and was fixed in Microsoft's November 2025 cumulative update. If that update is not deployed, an attacker who already has a foothold can reliably escalate to full system control.

The root cause is a classic Windows weakness: improper link resolution before file access, categorized as CWE-59. A scheduled task running as NT AUTHORITY\SYSTEM performs file operations inside a directory that a low-privileged user can write to. By planting an NTFS junction or symbolic link in that path, an attacker redirects the privileged process into writing, deleting, or manipulating files it was never meant to touch. The result is deterministic elevation with no crash and no user interaction beyond the initial low-privilege access.

That "local only" label is exactly why this flaw matters more than its 7.8 suggests. Initial access brokers already sell low-privilege footholds cheaply, and a reliable elevation is the missing piece a ransomware affiliate needs to disable endpoint protection, dump credentials from LSASS, delete volume shadow copies, and deploy the locker. The EPSS model puts this bug in the 90.9th percentile for exploitation probability, and CISA's ransomware flag confirms the theoretical risk is now operational.

Which Windows versions are affected, and what is the fix?

The vulnerability affects current Windows 11 servicing branches and Windows Server 2025, where the vulnerable task ships by default. Microsoft addressed it in the November 2025 security update; there is no separate configuration change required once the cumulative update is applied. Organizations on delayed patch cycles, air-gapped estates, or change-controlled server fleets are the exposed population, which is why a bug patched in late 2025 only reached active ransomware use months later.

How can defenders detect exploitation attempts?

Because the technique relies on reparse points, file-system telemetry is the highest-signal detection. Watch for junction or symbolic-link creation inside user-writable AppData paths, which surfaces as Sysmon Event ID 11 or equivalent EDR reparse-point events. Pair that with process-behavior monitoring on taskhostw.exe: unexpected writes or deletions into system directories, or that process spawning cmd.exe or powershell.exe, are strong indicators of post-exploitation. Confirm the November 2025 update is present across every Windows 11 and Server 2025 asset, and treat any host that cannot be patched immediately as a candidate for tighter application-control and shadow-copy protection.

Our read

This is the pattern our 2025 analysis of CISA KEV kept surfacing: a mid-range CVSS local bug that an annual pentest would likely deprioritize, yet it becomes a ransomware enabler within one patch cycle. Sixty-seven percent of 2025's actively-exploited vulnerabilities would have been missed by a once-a-year test, and the median gap from disclosure to exploitation was 26 days. Privilege escalation is where that math turns into an outage. The verifiable control is continuous verification: know which of your endpoints are actually on the November 2025 baseline, and prove it with telemetry rather than assuming the patch pipeline succeeded. That evidence is the difference between "we patched" and "we are protected."

Reporting by BleepingComputer; CVSS, EPSS and KEV status per NVD, FIRST.org and CISA. Sources linked above.

Related: Microsoft's August 2026 Patch Tuesday and what CVSS misses about exploitation.