453/69 Thursday, August 20, 2026
CISA disclosed that CVE-2025-60710, a vulnerability in Host Process for Windows Tasks, has been exploited in attacks by ransomware groups. CISA previously added the vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog in April 2026 after confirming evidence of active exploitation. The flaw is a Windows privilege escalation vulnerability, and Microsoft released patches to address it in November 2025.
The vulnerability is caused by a link-following flaw in Host Process for Windows Tasks. An attacker who already has access to a system with standard user privileges could exploit the flaw to escalate privileges to SYSTEM and take control of unpatched devices. CISA has not disclosed details about the ransomware attacks exploiting the vulnerability. Microsoft has also not updated its security advisory to confirm active exploitation.
CVE-2025-60710 affects Windows 11 and Windows Server 2025. Administrators should review and install Microsoft security updates as soon as possible, apply risk mitigation measures recommended by the vendor, and follow applicable requirements under BOD 22-01 for cloud services. If suitable mitigation measures are not available, organizations should consider discontinuing use of the affected product.