--- title: CISA: Windows Task Host flaw now exploited by ransomware... description: CISA has updated its Known Exploited Vulnerabilities catalog to confirm that ransomware gangs are now abusing CVE-2025-60710, a high-severity Windows Task Host... canonical: https://daily.dev/posts/cisa-windows-task-host-flaw-now-exploited-by-ransomware-gangs-wem3tecny twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: CISA: Windows Task Host flaw now exploited by ransomware gangs | daily.dev og:description: CISA has updated its Known Exploited Vulnerabilities catalog to confirm that ransomware gangs are now abusing CVE-2025-60710, a high-severity Windows Task Host... og:url: https://daily.dev/posts/cisa-windows-task-host-flaw-now-exploited-by-ransomware-gangs-wem3tecny og:image: https://api.daily.dev/og/posts/wEM3TEcny.png og:image:alt: CISA: Windows Task Host flaw now exploited by ransomware gangs og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # CISA: Windows Task Host flaw now exploited by ransomware gangs **[BleepingComputer](https://daily.dev/sources/bleepingcomputer)** · 2 min read · 0 upvotes · 0 comments ## Summary CISA has updated its Known Exploited Vulnerabilities catalog to confirm that ransomware gangs are now abusing CVE-2025-60710, a high-severity Windows Task Host privilege escalation flaw affecting Windows 11 and Windows Server 2025. The link-following vulnerability, patched by Microsoft in November 2025, lets local attackers with basic user permissions gain SYSTEM privileges. CISA first flagged it as actively exploited in April, giving federal agencies two weeks to patch; details of the ransomware attacks remain undisclosed, and Microsoft has not updated its advisory to confirm in-the-wild exploitation. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What is CVE-2025-60710 and which Windows versions are affected? CVE-2025-60710 is a high-severity Windows Task Host privilege escalation vulnerability caused by a link-following weakness, affecting Windows 11 and Windows Server 2025. It allows local attackers with only basic user permissions to gain SYSTEM privileges and take full control of an unpatched device. Microsoft patched it in the November 2025 Patch Tuesday update. _Teams tracking Windows privilege escalation patches can follow ongoing CVE coverage on daily.dev._ ### Is CVE-2025-60710 being exploited by ransomware groups? Yes, CISA updated its Known Exploited Vulnerabilities catalog to flag CVE-2025-60710 as being abused in ransomware attacks, after first adding it as actively exploited on April 13 with a two-week remediation deadline for federal agencies. No specific attack details or threat actor names have been disclosed, and Microsoft has not yet confirmed in-the-wild exploitation on its own advisory. _Security teams prioritizing ransomware-linked CVEs can track new KEV catalog updates on daily.dev._ ### How many Microsoft vulnerabilities have been exploited in ransomware attacks since 2021? Since November 2021, CISA has flagged 383 actively exploited vulnerabilities across various Microsoft products, and 112 of those have also been exploited specifically in ransomware attacks. This highlights how frequently Microsoft flaws become a pathway for ransomware operators once they are weaponized in the wild. _Anyone assessing Microsoft patch risk can follow ransomware-exploited CVE trends on daily.dev._ ## Similar posts on daily.dev - [CISA: Windows BlueHammer flaw now exploited by ransomware gangs](https://daily.dev/posts/cisa-windows-bluehammer-flaw-now-exploited-by-ransomware-gangs-8msc5m9tl) · BleepingComputer · 1 upvotes · 0 comments - [Ransomware scum, other crims exploit 4 old Microsoft bugs](https://daily.dev/posts/ransomware-scum-other-crims-exploit-4-old-microsoft-bugs-ez6lhkszs) · The Register · 0 upvotes · 0 comments - [CISA orders feds to patch Windows flaw exploited as zero-day](https://daily.dev/posts/cisa-orders-feds-to-patch-windows-flaw-exploited-as-zero-day-gw4v2yydq) · BleepingComputer · 1 upvotes · 0 comments - [Windows shell spoofing vulnerability puts sensitive data at risk](https://daily.dev/posts/windows-shell-spoofing-vulnerability-puts-sensitive-data-at-risk-39k3nizjs) · CSO Online · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#windows](https://daily.dev/tags/windows), [#ransomware](https://daily.dev/tags/ransomware) [View this post on daily.dev](https://daily.dev/posts/cisa-windows-task-host-flaw-now-exploited-by-ransomware-gangs-wem3tecny) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"CISA: Windows Task Host flaw now exploited by ransomware gangs","url":"https://daily.dev/posts/cisa-windows-task-host-flaw-now-exploited-by-ransomware-gangs-wem3tecny","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/cisa-windows-task-host-flaw-now-exploited-by-ransomware-gangs-wem3tecny"},"datePublished":"2026-08-18T10:39:34.403Z","dateModified":"2026-08-18T10:39:54.577Z","description":"CISA has updated its Known Exploited Vulnerabilities catalog to confirm that ransomware gangs are now abusing CVE-2025-60710, a high-severity Windows Task Host...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/7abd6529ec365ea2096ca51d42e58a30?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/7abd6529ec365ea2096ca51d42e58a30?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"BleepingComputer","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"BleepingComputer","logo":"https://media.daily.dev/image/upload/s--as8nJ3qy--/f_auto,q_auto/v1774959951/logos/bleepingcomputer?_a=BAMAMiWQ0","url":"https://daily.dev/sources/bleepingcomputer"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/cisa-windows-task-host-flaw-now-exploited-by-ransomware-gangs-wem3tecny","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,windows,ransomware","timeRequired":"PT2M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"BleepingComputer","item":"https://daily.dev/sources/bleepingcomputer"},{"@type":"ListItem","position":3,"name":"CISA: Windows Task Host flaw now exploited by ransomware gangs"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/cisa-windows-task-host-flaw-now-exploited-by-ransomware-gangs-wem3tecny#faq","mainEntity":[{"@type":"Question","name":"What is CVE-2025-60710 and which Windows versions are affected?","acceptedAnswer":{"@type":"Answer","text":"CVE-2025-60710 is a high-severity Windows Task Host privilege escalation vulnerability caused by a link-following weakness, affecting Windows 11 and Windows Server 2025. It allows local attackers with only basic user permissions to gain SYSTEM privileges and take full control of an unpatched device. Microsoft patched it in the November 2025 Patch Tuesday update. Teams tracking Windows privilege escalation patches can follow ongoing CVE coverage on daily.dev."}},{"@type":"Question","name":"Is CVE-2025-60710 being exploited by ransomware groups?","acceptedAnswer":{"@type":"Answer","text":"Yes, CISA updated its Known Exploited Vulnerabilities catalog to flag CVE-2025-60710 as being abused in ransomware attacks, after first adding it as actively exploited on April 13 with a two-week remediation deadline for federal agencies. No specific attack details or threat actor names have been disclosed, and Microsoft has not yet confirmed in-the-wild exploitation on its own advisory. Security teams prioritizing ransomware-linked CVEs can track new KEV catalog updates on daily.dev."}},{"@type":"Question","name":"How many Microsoft vulnerabilities have been exploited in ransomware attacks since 2021?","acceptedAnswer":{"@type":"Answer","text":"Since November 2021, CISA has flagged 383 actively exploited vulnerabilities across various Microsoft products, and 112 of those have also been exploited specifically in ransomware attacks. This highlights how frequently Microsoft flaws become a pathway for ransomware operators once they are weaponized in the wild. Anyone assessing Microsoft patch risk can follow ransomware-exploited CVE trends on daily.dev."}}]} ```