CVE-2025-60710highunder attackransomwareCWE-59

CVE-2025-60710: high-severity vulnerability in Microsoft Windows 11 Version 24H2

Host Process for Windows Tasks Elevation of Privilege Vulnerability

Published · Updated

73Vexday Risk Score

Prioritize patching. It under exploitation confirmed by CISA and has a public proof of concept.

ssvc Actcvss 7.8epss 4.6%
from disclosure to weapon0 days
Published on NVDNov 11
1st PoCNov 11
CISA KEV+153d
exploitation probability
4.6%top 8% of all CVEs
observed exploitation
yesCISA + VulnCheck
4 public exploit(s)
Action required by CISAfederal deadline: 2026-04-27

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

In short

A flaw in Windows Tasks Host Process allows an authorized user on the system to gain higher privileges by exploiting how the system resolves file links. An attacker with local access can trick the system into accessing files they shouldn't be able to reach, gaining admin-level permissions.

Technical detail

CWE-59 link following vulnerability in Host Process for Windows Tasks enables local privilege escalation when the process improperly resolves symbolic or hard links before file access. An authenticated local attacker can exploit this to execute arbitrary code with elevated privileges; requires prior local system access.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

Improper link resolution before file access ('link following') in Host Process for Windows Tasks allows an authorized attacker to elevate privileges locally.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
Affected products
Microsoft · Windows 11 Version 24H2Microsoft · Windows 11 Version 25H2Microsoft · Windows Server 2025Microsoft · Windows Server 2025 (Server Core installation)
public PoCs found — 4
githubgithub.com/redpack-kr/CVE-2025-60710★ 24githubgithub.com/Wh04m1001/CVE-2025-60710★ 5vulncheckvulncheck.com/xdb/87cb0283aebfunverifiedvulncheckvulncheck.com/xdb/fa5898cfcf0cunverified
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Microsoft Windows 11 Version 24H2

In the same product, most dangerous first.

CVE-2025-59287CRITICALWindows Server Update Service (WSUS) Remote Code Execution VulnerabilityEPSS 100.0%KEVCVE-2025-33053HIGHInternet Shortcut Files Remote Code Execution VulnerabilityEPSS 87.0%KEVCVE-2024-43451MEDIUMNTLM Hash Disclosure Spoofing VulnerabilityEPSS 84.3%KEVCVE-2025-33073HIGHWindows SMB Client Elevation of Privilege VulnerabilityEPSS 82.7%KEVCVE-2024-43572HIGHMicrosoft Management Console Remote Code Execution VulnerabilityEPSS 66.7%KEVCVE-2025-24054MEDIUMNTLM Hash Disclosure Spoofing VulnerabilityEPSS 62.3%KEV
References
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-60710https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-60710https://www.vicarius.io/vsociety/posts/cve-2025-60710-detection-script-eop-vulnerability-in-host-process-for-windows-taskshttps://www.vicarius.io/vsociety/posts/cve-2025-60710-mitigation-script-eop-vulnerability-in-host-process-for-windows-tasks