Summary
- CISA says CVE-2025-60710 is being used in ransomware campaigns after previously identifying the Windows flaw as actively exploited.
- The vulnerability affects Windows Task Host and can allow an attacker with existing access to elevate privileges on a vulnerable machine.
- Microsoft patched the flaw in November 2025, making residual risk dependent largely on systems that remain unpatched or inconsistently managed.
Ransomware operators are exploiting a patched Microsoft Windows privilege-escalation vulnerability, according to the US Cybersecurity and Infrastructure Security Agency, adding another known flaw to attack chains targeting Windows environments.
The vulnerability, tracked as CVE-2025-60710, affects Windows Task Host and was addressed by Microsoft in November 2025. CISA now lists the flaw in its Known Exploited Vulnerabilities catalogue and marks it as known to have been used in ransomware campaigns.
The issue is a link-following weakness that can allow an attacker who already has access to a system to obtain higher privileges. That distinction is important: it is not described as a vulnerability that lets an unauthenticated attacker compromise a Windows machine directly from the internet. Its value comes after initial access, when an intruder is trying to turn a foothold into greater control of the host.
Microsoft’s affected-product information includes Windows 11 and Windows Server 2025. Systems that received the relevant security update are protected against the vulnerability itself, but the ransomware designation gives organisations another reason to check whether older or inconsistently managed machines remain exposed.
CISA had already flagged CVE-2025-60710 as actively exploited. The addition of ransomware-use information gives the vulnerability a more specific operational context, showing that exploitation has moved beyond opportunistic testing or isolated intrusion activity into attack chains associated with extortion.
Privilege escalation strengthens an existing foothold
Ransomware intrusions rarely depend on a single vulnerability from start to finish. Attackers may obtain initial access through stolen credentials, exposed remote services, phishing, vulnerable edge devices, or another software flaw before using local privilege-escalation bugs to deepen their control.
Higher privileges can make subsequent stages of an attack easier by expanding access to local security settings, credentials, services, and protected resources. In enterprise environments, that can help an attacker prepare for credential theft, lateral movement, security-tool interference, or deployment of ransomware across additional systems.
CVE-2025-60710 therefore illustrates why vulnerabilities that appear less dramatic than remote-code-execution bugs can still be useful to ransomware operators. A local escalation flaw may not create the original breach, but once an attacker is inside, it can remove controls that would otherwise limit the intrusion.
The age of the patch also matters. Microsoft fixed the vulnerability in November 2025, yet CISA’s ransomware designation arrives months later. That lag reflects the long exploitation window created by incomplete patch deployment, unsupported assets, machines that fall outside central management, and operational systems where updates are deferred.
For larger Windows estates, exposure is rarely determined by whether a patch exists. It depends on whether every relevant device received it, whether exceptions were tracked, and whether systems rebuilt from older images were brought up to date before returning to production.
CISA’s catalogue is intended to focus attention on vulnerabilities with evidence of real-world exploitation rather than theoretical severity alone. Its ransomware flag adds another layer by identifying flaws that have appeared in campaigns where disruption and extortion are established outcomes.
The designation does not mean every ransomware incident involving Windows uses CVE-2025-60710, nor does it establish which ransomware groups have used it in particular attacks. What it does establish is that the flaw has moved into a class of vulnerabilities with confirmed operational value to ransomware actors.
For Windows environments that have not fully absorbed last year’s security updates, the finding turns an older patch-management issue into a current attack-path concern. The vulnerability has been fixed for months; the remaining exposure sits in systems where that fix has not reached the machine attackers are able to access.
