CVE-2025-60710
Sfruttamento noto · CISA KEV
CVSS 7.8 HIGH: improper link resolution before file access ('link following') in Host Process for Windows Tasks allows an authorized… EPSS 5% (91º percentile).
Data di correzione federale CISA 27 apr
Vulnerabilità ed exploit
A low-complexity link-following bug in a core Windows background host turns basic local access into full SYSTEM control. The standard response is not enough here: patching closes the flaw, but any attacker who already has a foothold can still use it to take over the machine.
CISA added CVE-2025-60710 to its actively exploited catalog and told federal civilian agencies to move within two weeks. Microsoft patched the issue in November 2025 for Windows 11 and Windows Server 2025, and the flaw lets an authorized local attacker with basic permissions elevate to SYSTEM.
The risk is not remote break-in. It is privilege escalation from a low-privilege account on systems that often sit inside trusted enterprise and government environments, where SYSTEM access can be enough to disable controls, steal data, or pivot deeper.
1 fonte · 15 apr
Sfruttamento noto · CISA KEV
CVSS 7.8 HIGH: improper link resolution before file access ('link following') in Host Process for Windows Tasks allows an authorized… EPSS 5% (91º percentile).
Data di correzione federale CISA 27 apr
BleepingComputer
CISA flags Windows Task Host vulnerability as exploited in attacks
government agencies to secure their systems against a Windows Task Host privilege escalation vulnerability that could allow attackers to gain SYSTEM privileges.
originaleRiepilogo fornitore: Microsoft
Part of the PlainSec briefing for 2026-04-16
Every edition of this story: Windows Task Host Flaw Gives Local Users SYSTEM