Host Process for Windows Tasks Elevation of Privilege Vulnerability (CVE-2025-60710)
Published Last modified In CISA KEV since Sources: CVE.org, Msrc Update Guide, pwn.watch
What is affected, what to do
Improper link resolution before file access ('link following') in Host Process for Windows Tasks allows an authorized attacker to elevate privileges locally.
The vulnerability is being actively exploited; treat it as a priority. CISA lists it as used in ransomware campaigns. Update Microsoft Windows 11 Version 24H2 to version 10.0.26100.7462, Microsoft Windows 11 Version 25H2 to version 10.0.26200.7462, Microsoft Windows Server 2025 to version 10.0.26100.7462. Immediate actions, mitigation and detection rules are in the runbook below.
- Affected
- Microsoft Windows 11 Version 24H2
lt 10.0.26100.0..10.0.26100.7462 - Microsoft Windows 11 Version 25H2
lt 10.0.26200.0..10.0.26200.7462 - Microsoft Windows Server 2025
lt 10.0.26100.0..10.0.26100.7462 - Microsoft Windows Server 2025 (Server Core installation)
lt 10.0.26100.0..10.0.26100.7462
- Microsoft Windows 11 Version 24H2
- Fixed in
- Microsoft Windows 11 Version 24H2
10.0.26100.7462 - Microsoft Windows 11 Version 25H2
10.0.26200.7462 - Microsoft Windows Server 2025
10.0.26100.7462 - Microsoft Windows Server 2025 (Server Core installation)
10.0.26100.7462
- Microsoft Windows 11 Version 24H2
Not sure whether and how you are affected? Ask a question about this vulnerability
Metrics
7.8
Priority
XIEM Effective CVSS: highest available CVSS rating from NVD and vendor data.
Source: NVD, CVSS v3
7.8
CVSS v3
Severity High on the scale from 0 to 10.
Source: CVE.org, Msrc Update Guide, pwn.watch
4.6 %
EPSS score
Moderate — model estimates 1-10% exploitation likelihood.
Source: FIRST EPSS, percentile 91.6
Show all metrics
- Severity
- Critical
Priority (0–325)
The priority score is a consolidated metric that condenses several individual signals into a single, action-guiding ranking: technical severity (CVSS), exploitation likelihood (EPSS), known-exploited status (KEV) and the context of the affected asset. The aim is to answer the only truly important question in vulnerability management: what first?
Read in glossary- 243.32 Methodology
Exploit maturity
An exploit is code or a technique that specifically uses a concrete vulnerability to force unintended behaviour — such as executing code or escalating privileges. It is the tool that turns a theoretical flaw into a practical attack.
Read in glossary- actively exploitedSource: VulnCheck KEV (opens in a new tab) How we classify
XIEM Effective CVSS
XIEM® is the tiered managed-security operating model from NEOSEC and a registered trademark of NEOSEC GmbH. It extends classic SIEM — the central collection, normalisation and correlation of security-relevant events — with endpoint forensics, network visibility and deception technology, and consolidates them into three building tiers: Sentry, Orchestrate and Command.
Read in glossary- 7.8 Methodology
CVSS v3
CVSS is the globally established, open standard for assessing the technical severity of a vulnerability on a scale from 0 to 10. It describes how easily a flaw can be exploited and what damage it can cause — but not how likely its actual exploitation is. CVSS and the complementary EPSS deliberately answer different questions.
Read in glossary- 7.8
EPSS score
The EPSS score is the absolute model output for an individual vulnerability: the estimated probability of real-world exploitation within the next 30 days, expressed as a value between 0 and 1 (i.e. 0 % to 100 %). A score of 0.42 means „the model estimates a 42 % chance of real-world exploitation within 30 days“.
Read in glossary- 4.6 %
- Moderate — model estimates 1-10% exploitation likelihood.
EPSS percentile
The EPSS percentile is the relative position of a vulnerability within all EPSS-scored CVEs, expressed as a value between 0 and 1. A percentile of 0.90 means „this CVE has a higher EPSS score than 90 % of all other scored CVEs“. Unlike the EPSS score, it is not a probability — but a positioning within a ranking.
Read in glossary- 91.6
- Critical — this CVE ranks in the top fifth of all CVEs scored today (rank ≥ 80%).
KEV status
The KEV catalogue is a list maintained by the US authority CISA of vulnerabilities for which active exploitation in the wild has been confirmed. It answers not the question „how severe?“ but „is it already being attacked?“ — thereby sharply prioritising patching.
Read in glossary- Actively exploited
- Published
In CISA KEV since
The KEV catalogue is a list maintained by the US authority CISA of vulnerabilities for which active exploitation in the wild has been confirmed. It answers not the question „how severe?“ but „is it already being attacked?“ — thereby sharply prioritising patching.
Read in glossaryCWE
CWE is a catalogue of typical weakness types in software and hardware — such as flawed input validation, unsafe memory handling or poor authentication. Where a CVE names a concrete vulnerability in a concrete product, a CWE describes the underlying class of defect.
Read in glossary- CWE-59
Response and mitigation
Why act now?
Prioritisation rationale
The bug needs local, low-privileged access but no user interaction. It reliably turns an ordinary user foothold into SYSTEM, which makes it a textbook second stage after phishing, infostealer infections or abused VPN accounts. CISA flags known ransomware campaign use, and operators chain local privilege escalations like this to disable EDR, dump credentials and wipe shadow copies before encryption. Exploitation likelihood is well above the CVE baseline, and virtually every Windows estate is in scope. Patch within the KEV deadline at the latest, and immediately on multi-user systems. NIS2/KRITIS entities should treat any detection hit as a potential precursor to a reportable incident.
Runbook step 1
Immediate response (0-24 h)
- Deploy Microsoft's security update for CVE-2025-60710 (Host Process for Windows Tasks,
taskhostw.exe) as a priority. An official fix exists; look up the exact KB per Windows build in the Microsoft Security Update Guide (MSRC) and push it as an out-of-band ring via WSUS, Intune or ConfigMgr. - Patch multi-user and high-exposure hosts first: RDS/AVD/Citrix session hosts, jump hosts, admin workstations and internet-browsing clients. These are where an attacker is most likely to have the low-privileged foothold this bug needs.
- Review hosts with recent initial-access signals (phishing hits, infostealer or loader alerts in the last 30 days) for follow-on privilege escalation. If you find evidence, isolate the host via EDR and treat local and cached credentials as compromised.
- Rotate local administrator passwords through Windows LAPS. On affected hosts, also reset service-account passwords with cached sessions, since SYSTEM access enables LSASS credential theft.
- Switch EDR policies from audit to block mode and confirm tamper protection is enforced. Ransomware operators routinely use SYSTEM rights to kill security tooling.
- Deploy Microsoft's security update for CVE-2025-60710 (Host Process for Windows Tasks,
Runbook step 2
Mitigation layers
- Endpoint hardening: Use WDAC or AppLocker to block unsigned binaries from user-writable paths (
%LOCALAPPDATA%,%TEMP%,C:\Users\Public,C:\ProgramData). This cuts off common junction and object-manager-symlink exploit tooling, such as symboliclink-testing-tools derivatives. - Defender ASR rules: Enable "Block executable files from running unless they meet a prevalence, age, or trusted list criterion", "Block credential stealing from LSASS" and "Block process creations originating from PSExec and WMI commands". These rules break the post-escalation chain.
- IAM / least privilege: Restrict interactive logon on servers via GPO ("Allow log on locally") to the groups that need it. Remove local admin rights from standard users. Enforce a tiering model so SYSTEM on a workstation does not expose Tier-0 credentials.
- Network segmentation: Block workstation-to-workstation SMB (445/tcp), RDP (3389/tcp) and WinRM (5985/5986/tcp) at the host firewall. This contains the lateral movement that typically follows escalation.
- Configuration: Until patched, enable SACL auditing on directories
taskhostw.exeoperates on underC:\Windows\System32\TasksandC:\ProgramData\Microsoft. This surfaces redirection attempts.
- Endpoint hardening: Use WDAC or AppLocker to block unsigned binaries from user-writable paths (
Runbook step 3
Detection rules
- Sysmon EID 1 / Security 4688: Watch for unusual children of
taskhostw.exerunning at System integrity, such ascmd.exe,powershell.exe,rundll32.exeor binaries from user paths. KQL sketch:DeviceProcessEvents | where InitiatingProcessFileName =~ "taskhostw.exe" and ProcessIntegrityLevel == "System" and FolderPath has_any ("\\Users\\","\\Temp\\","\\ProgramData\\") - Junction/symlink creation by standard users: Flag
mklink /Jormklink /Dand unknown tools creating reparse points in user-writable directories when they occur within minutes oftaskhostw.exefile activity. Data source: EDR file telemetry (ReparsePoint attribute) or Security 4663 with SACLs. - Sysmon EID 11 / EID 7: Look for file writes by
taskhostw.exeoutside expected paths, especially DLLs or EXEs landing inC:\Windows\System32. Also flag SYSTEM processes loading DLLs from user-writable locations. - Post-escalation activity: Security 4697 / System 7045 (new service), 4720/4732 (local account created or added to Administrators), Sysmon EID 10 targeting
lsass.exe, andvssadmin delete shadowsorwbadmin delete catalog. A Sigma correlation of "user-created junction → SYSTEM process from user path within 10 min" links the exploit to its effect.
- Sysmon EID 1 / Security 4688: Watch for unusual children of
Detection rules
No NEOSEC detection rule is available for this vulnerability yet.
Classification under NIS2 and CRA
Rule-based classification from exploitation status and severity. It does not replace a case-by-case assessment.
NIS2
NIS2 is EU Directive (EU) 2022/2555 to raise the level of cybersecurity across the Union. It substantially broadens obligations compared with the first NIS directive: more sectors, mandatory risk management, staged reporting duties and personal accountability of senior management.
Read in glossary- Actively exploited: treat the vulnerability as a priority in vulnerability handling under Art. 21(2)(e) NIS2. If it is exploited in your environment, check the reporting obligation under Art. 23 (early warning within 24 hours).
CRA
The CRA is EU Regulation (EU) 2024/2847 setting horizontal cybersecurity requirements for „products with digital elements“ — from industrial controllers and software to connected consumer devices. For the first time manufacturers must ensure security across the entire product lifecycle, handle vulnerabilities and provide security updates.
Read in glossary- Since 11.09.2026, manufacturers of affected products with digital elements must report actively exploited vulnerabilities under Art. 14 CRA, with an early warning within 24 hours via ENISA's single reporting platform.
ISO/IEC 27001
ISO/IEC 27001 is the internationally leading standard for an information security management system (ISMS). It describes a risk-based, process-oriented framework to systematically plan, implement, review and improve information security.
Read in glossary- Control A.8.8, management of technical vulnerabilities: assess relevance to your systems, plan remediation and keep evidence.
Description
Improper link resolution before file access ('link following') in Host Process for Windows Tasks allows an authorized attacker to elevate privileges locally.
Source: NVD (NIST), CISA KEV Catalog, CVE.org (MITRE), cvelistv5, Microsoft Security Update Guide, pwn.watch
Affected products
The following versions are affected. Older releases of the same product line are also vulnerable unless stated otherwise.
| Affected versions | Fixed in | ||
|---|---|---|---|
| Microsoft | Windows 11 Version 24H2 |
|
|
| Microsoft | Windows 11 Version 25H2 |
|
|
| Microsoft | Windows Server 2025 |
|
|
| Microsoft | Windows Server 2025 (Server Core installation) |
|
|
Vendors and products
Affected operating systems
| Windows | microsoft | windows_11_24h2 | — |
| Windows | microsoft | windows_11_25h2 | — |
| Windows | microsoft | windows_server_2025 | — |
Weakness classes (CWE)
CWE-59Improper Link Resolution Before File Access ('Link Following')
Base
The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.
Entry at MITRE CWE-59
Public exploit references
Publicly reported proof-of-concepts, exploit modules and detection templates for this vulnerability. NEOSEC links to the original sources only and does not provide any exploit code.
| CISA KEV Catalog | CISA Known Exploited Vulnerability (opens in a new tab)cisa.gov | actively exploited |
References & sources
- Microsoft Security Update GuideHost Process for Windows Tasks Elevation of Privilege VulnerabilityVendor advisory, Patch, Vendor advisory, pwn-watch
- cisa.govknown-exploited-vulnerabilities-catalog?field_cve=CVE-2025-60710government-resource, US government resource
- vicarius.iovsociety/posts/cve-2025-60710-detection-script-eop-vulnerabilit…Third-party advisory
- vicarius.iovsociety/posts/cve-2025-60710-mitigation-script-eop-vulnerabili…Mitigation, Third-party advisory
- pwn.watchpwn.watch: Microsoft Windows: Microsoft Windows Link Following Vulnerabilitypwn-watch
- NVD (NIST)NVD: CVE-2025-60710pwn-watch
- Microsoft Security Update GuideMicrosoft Windows — CVE-2023-36424pwn-watch
- NVD (NIST)NVD: CVE-2023-36424pwn-watch
- cisa.govCISA Known Exploited Vulnerabilities Catalogpwn-watch
Changes to this CVE
Who changed this CVE and when: NVD (analysis, affected products, CVSS), the CVE publisher (CNA) and additional providers such as CISA (ADP).
One NVD translation into another language is hidden.
Embed badge
Show the severity and KEV status of this vulnerability on your site – with a link back here. The image is updated hourly.
<a href="https://intel.neosec.eu/en/cve/CVE-2025-60710"><img src="https://intel.neosec.eu/badge/cve/CVE-2025-60710.svg?lang=en" alt="CVE-2025-60710 – NEOSEC Intel" height="20"></a>