The Windows Task Host flaw CVE-2025-60710 becomes a ransomware weapon in CISA’s KEV catalog

November 2025. Microsoft patches CVE-2025-60710, a privilege-escalation flaw in Windows Task Host, a core component of Windows 11 and Windows Server 2025. April 13, 2026. CISA adds it to the KEV catalog of actively exploited vulnerabilities. August 14, 2026. The agency updates the entry to flag that ransomware gangs are now exploiting the flaw.

The event is less spectacular than a remote code execution — and that is exactly why it is dangerous. A local privilege escalation often drops to the bottom of patch priorities, yet it is the link that turns an ordinary user account into full SYSTEM control.

What Task Host is and what the flaw allows

Task Host (taskhostw.exe) is a system component that lets DLL-based processes run in the background and prevents data corruption by making sure they close cleanly at shutdown. It is a foundational piece of Windows, present on every machine.

CVE-2025-60710 is classified as a link-following weakness (CWE-59). In practice, the component follows a link without validating its target, which an attacker can abuse to redirect the operation to a file of their choosing.

The result fits in one sentence: a local attacker with basic user permissions can gain SYSTEM privileges and take full control of an unpatched device. It is a local escalation — you already need a foothold on the machine — but it is precisely the kind of primitive ransomware operators chain after an initial access via phishing or an exposed vulnerable service.

The timeline of a flaw that refuses to die

The trajectory of CVE-2025-60710 illustrates the lifecycle of an under-exploited vulnerability:

• November 2025. Microsoft ships the fix and documents the flaw in its MSRC advisory.
• April 13, 2026. CISA adds the flaw to the KEV catalog, signaling confirmed active exploitation, and gives Federal Civilian Executive Branch (FCEB) agencies two weeks to remediate.
• August 14, 2026. CISA updates the entry: the flaw is now exploited by ransomware gangs.

The agency has not yet shared details on ongoing campaigns, and Microsoft has not updated its advisory to confirm widespread in-the-wild exploitation. But the move from “actively exploited” to “exploited by ransomware gangs” is a severity signal in its own right.

It is part of a pattern. A week earlier, CISA warned that ransomware gangs had begun exploiting a Microsoft SharePoint RCE (CVE-2026-45659). The overall picture is clear: extortion groups no longer only target remote-office flaws, they integrate privilege escalations into their attack chains.

Privilege escalation, the forgotten link in ransomware

The number CISA puts forward is the most telling: since November 2021, the agency has cataloged 383 actively exploited vulnerabilities in Microsoft products, 112 of which have also been used in ransomware attacks. Nearly one in three.

Why does that ratio matter? Because ransomware does not fall from the sky. The classic chain combines an initial access — stolen credentials, phishing, an exposed service — then a privilege escalation to escape the user account, lateral movement, and finally encryption and extortion. Every link is a chance to detect and stop the attack; privilege escalation is the one that unlocks all the others.

A flaw like CVE-2025-60710 is therefore a severity multiplier: taken in isolation, it requires local access; combined with an initial access, it hands over the whole machine. That is why CISA treats it with the same urgency as an RCE — and why teams that triage patches by raw CVSS score risk missing it: a “moderate” local privilege escalation can be decisive in the context of a full attack chain.

What CISA says and what to do

The agency’s guidance is direct: “Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.” It adds that this type of vulnerability is a “frequent attack vector for malicious cyber actors.”

The operational translation is simple:

• Prioritize the November 2025 fix on Windows 11 and Windows Server 2025 if it is not already deployed — the flaw is actively exploited, including by ransomware;
• Correlate your logs: a successful privilege escalation shows up in security events tied to execution-context changes;
• Treat privilege escalation as a first-class signal in your risk matrix, instead of relegating it behind RCEs;
• Check exposure on Windows Server 2025 machines in particular, which are often deployed without the same patch cadence as endpoints.

Why this patch slips through

CVE-2025-60710 illustrates a common prioritization bias. A local privilege escalation requires an attacker to already have a foothold on the system — which teams often translate as “less urgent than an RCE.” Yet this is exactly the link ransomware operators hunt for once they have initial access, and CISA now says so explicitly.

The technical vector plays a part too. A link-following weakness (CWE-59) leaves no spectacular signature: the Task Host component follows a link to an attacker-chosen target, and the operation looks like ordinary behavior. Without log correlation — execution-context changes, processes spawned by SYSTEM from a user account — the exploitation goes unnoticed. The primitive is quiet by design, which is why it survived for months between patch and KEV flag.

The scope matters as well. The flaw affects Windows 11 and Windows Server 2025, two systems still widely in their deployment phase, where patch policies are often less mature than on older, battle-tested releases. A freshly installed 2025 server missing the November 2025 fix is a prime target for a ransomware operator looking to turn a service account into SYSTEM.

The practical takeaway for a patch team is simple arithmetic. A local escalation that carries a KEV entry marked “ransomware” is no longer a theoretical risk; it is a step in an observed extortion chain. Ranking it below an RCE by raw CVSS score mistakes severity for exploitability — the very distinction the KEV catalog exists to correct. When the catalog updates a single field, treat it as the loudest signal in your queue, not the quietest. The four-month gap between the November 2025 patch and the April 2026 KEV entry is the window in which the flaw did its quiet work — and the reason every unpatched machine from that window matters.

Verdict

If you run a Windows 11 or Windows Server 2025 fleet, verify today that the CVE-2025-60710 fix is applied: a flaw exploited by ransomware leaves no time to wait for the next maintenance window.

If you prioritize patches by CVSS score, add one rule: any vulnerability in the KEV catalog — and a fortiori one flagged “ransomware” — jumps to the front of the queue regardless of score. The KEV reflects real exploitation, not theory.

The bottom line: ransomware gangs are industrializing privilege escalation. The Task Host flaw is not the most publicized of the year, but it is the kind of quiet link a whole extortion chain can lean on.

References

• BleepingComputer — CISA: Windows Task Host flaw now exploited by ransomware gangs, August 18, 2026
• NVD — CVE-2025-60710 Detail, accessed August 18, 2026
• Microsoft Security Response Center — CVE-2025-60710, accessed August 18, 2026
• CISA — Known Exploited Vulnerabilities Catalog, accessed August 18, 2026
• CISA — CISA Adds Seven Known Exploited Vulnerabilities to Catalog, April 13, 2026