Windows Task Host flaw CVE-2025-60710 gives a local user SYSTEM, and ransomware gangs now exploit it

A privilege-escalation bug that Microsoft fixed nine months ago has just become a ransomware tool. On Friday, CISA updated its Known Exploited Vulnerabilities catalog to mark CVE-2025-60710, a flaw in a core Windows background component, as used in ransomware campaigns. The patch has been available since November 2025. The exploitation is current. That gap is the whole story.

The flaw sits in the Host Process for Windows Tasks, the service (taskhostw.exe) that keeps library-based background jobs running and closes them cleanly at shutdown. A local user with ordinary permissions can abuse it to reach SYSTEM, the highest privilege level on a Windows host. CISA first flagged it as actively exploited in April. The ransomware label is the new development, and it changes how urgently server teams should be checking their fleet.

A nine-month-old fix, freshly weaponized

Track the dates and the pattern is hard to miss. Microsoft shipped the fix in its November 2025 update. CISA added the bug to the KEV catalog on April 13, 2026, with a federal remediation deadline of April 27. This month it flipped the entry's ransomware indicator to "Known." So a flaw that defenders could have closed last autumn spent the spring under active exploitation and is now part of ransomware playbooks.

CISA did not name the crews using it, and no public proof-of-concept is called out in the advisory. That absence of a marquee exploit is exactly why this is easy to under-rate. There is no dramatic zero-day headline here, just a solved problem that a lot of servers never actually applied.

What the flaw gives an attacker

CVE-2025-60710 is a link-following weakness, tracked as CWE-59: improper link resolution before file access. In plain terms, the vulnerable code follows a filesystem link (a symlink or junction) to a location the attacker controls, and acts on it with the privileges of the SYSTEM-level task host instead of the attacker's own. The result is a local elevation of privilege. Microsoft rates it CVSS 7.8, high but not critical, and the vector needs only local access from a low-privileged account, with no user interaction and no unusual preconditions.

It is not remotely exploitable on its own. An attacker needs code running on the box first. What it buys them, once they are in, is a clean promotion from a limited account to full control of the machine.

The affected set is narrow but current: Windows 11 and Windows Server 2025. The fixed build is the number that matters, because "we installed November's update" is not the same as "every host is on the fixed build."

Why a local bug becomes a ransomware prize

Local privilege escalation rarely makes the front page, and that is precisely why attackers love a reliable one. A ransomware intrusion is a chain: get in through a phished credential or an exposed service, escalate to SYSTEM or domain admin, turn off defenses, spread, then encrypt. The initial-access flaws get the coverage. The escalation rung, the step that turns a foothold into ownership of the host, is where an operator quietly needs a dependable primitive. A patched, well-documented Windows LPE with no user interaction is a dependable primitive.

CISA's own numbers frame the pattern. Since November 2021 the agency has catalogued 383 actively exploited Microsoft vulnerabilities, and 112 of them, close to a third, have also shown up in ransomware attacks. Post-access flaws like this one are over-represented in that second bucket for a simple reason: every intrusion that ends in encryption has to escalate somewhere along the way. We have seen the same logic play out in campaigns that lean on patch lag rather than novelty, such as INC ransomware, which built its whole operation on unpatched edge devices instead of a single zero-day.

The detection lesson follows from the kill-chain position. By the time CVE-2025-60710 fires, the intruder is already on the host, so a rule keyed to this one CVE will always be late. The higher-value signal is the behavior around it: a low-privileged process creating symlinks or junctions into privileged paths, an ordinary user's process suddenly holding a SYSTEM token, or a background task host spawning something it has no business spawning. That is the same behavioral posture that catches ransomware crews reaching for other escalation and evasion tricks, from Akira rebooting Windows into Safe Mode to disable security tools to Gunra backdooring the login server itself.

Confirm the build number, then close the window behind you

Do two things, in order. First, verify remediation by build, not by memory. On every Windows 11 and Server 2025 host, confirm the running build is at or above 10.0.26100.7462 (24H2 and Server 2025) or 10.0.26200.7462 (25H2). A fleet that "got November's update" can still hold stragglers that missed the reboot or were imaged from an older base. Servers lag desktops on patch adoption, and Server 2025 is the exposed population here.

Second, if any host sat unpatched between April and now, treat the escalation window as potentially used, not theoretically open. This bug was under active exploitation for months before the ransomware label landed. Hunt backward: look for unexpected SYSTEM-level processes, new local admin or service accounts, symlink and junction creation in system directories, and the defense-evasion steps that usually follow a successful escalation. Patching closes the door. It does not tell you whether someone already walked through it. For the same reason, treat any Windows LPE that grants SYSTEM as a ransomware pre-stage worth prioritizing, not a low-severity local nuisance, and fold this month's Microsoft patch cycle into the same check.