CVE-2025-60710

What it actually does

CVE-2025-60710 is a local privilege-escalation vulnerability in Microsoft Windows caused by improper link resolution before file access in the Host Process for Windows Tasks. A low-privileged authenticated user can abuse symbolic links, junctions, hard links, or similar reparse-point behavior so that a privileged Windows task-host operation accesses or modifies an attacker-chosen file path. Successful exploitation can allow elevation to high-privilege local context, with potential full compromise of confidentiality, integrity, and availability on the affected system. The flaw affects Windows 11 24H2, Windows 11 25H2, and Windows Server 2025 and has been added to CISA KEV, indicating confirmed exploitation in the wild.

Why it matters to the business

An attacker who already has basic local access to an affected Windows endpoint or server may be able to become an administrator or SYSTEM-level user, enabling credential theft, disabling security tools, persistence, lateral movement, data access, or deployment of additional malware. Because this vulnerability is listed in CISA KEV with a remediation due date of 2026-04-27 and active exploitation has been reported, organizations should treat it as a high-priority patching and exposure-reduction issue even though it is not currently identified as ransomware-used in KEV.

How an attack unfolds

Exploitation requires an attacker to have an authenticated local foothold, such as a compromised standard user account, malware running as a user, or interactive access through another weakness. The attacker prepares a filesystem link, such as a symlink, junction, hard link, or reparse point, that redirects a path expected to be handled safely by the Windows Host Process for Windows Tasks to a protected target. The attacker then triggers or waits for the privileged task-host operation to access that path. Because the vulnerable component does not properly resolve or validate the final link target before file access, the privileged process can be tricked into performing an operation on a file or location controlled by the attacker. Depending on the primitive exposed by the vulnerable code path, this can be used to overwrite, replace, or manipulate protected resources and ultimately execute code or gain control under a higher-privilege local security context. In real intrusions, this type of flaw is commonly chained after initial access to turn a limited foothold into endpoint or server takeover.

How to fix it

Apply the Microsoft security update that remediates CVE-2025-60710 for all affected Windows 11 24H2, Windows 11 25H2, and Windows Server 2025 systems. Because no explicit fixed build numbers were provided in the input, use the latest applicable cumulative update from Microsoft Update, Windows Server Update Services, Microsoft Update Catalog, or the organization’s endpoint-management platform, and verify that the update superseding the November 2025 security release or later is installed. Prioritize internet-exposed administration workstations, shared servers, jump hosts, developer workstations, virtual desktop infrastructure, and systems where untrusted users can log on locally or run code. If immediate patching is not possible, reduce risk by limiting local logon rights, removing unnecessary interactive access, enforcing least privilege, monitoring and restricting symlink/junction/hard-link creation where feasible, enabling endpoint detection controls for suspicious reparse-point abuse, and preventing low-privileged users from writing to directories used by privileged services or scheduled tasks. There is no complete mitigation equivalent to applying the vendor fix.

How to confirm the fix worked

Confirm remediation by verifying that affected systems have installed the relevant Microsoft cumulative security update that includes the fix for CVE-2025-60710, then confirm OS build and patch level through Windows Update history, Microsoft Update compliance reporting, endpoint-management inventory, or PowerShell commands such as Get-HotFix and system build checks. Validate exposure reduction by confirming affected product versions are no longer missing the applicable security update, local non-admin users cannot write to privileged task or service paths, and unnecessary local interactive access has been removed. For assurance, run authenticated vulnerability scans or configuration compliance checks that explicitly test for the Microsoft advisory state for this CVE. Where exploit simulation is permitted, use a controlled lab-only validation to ensure known reparse-point/link-following privilege-escalation techniques no longer succeed on patched builds.

Typical attack path

1. Gain local authenticated access to an affected Windows 11 24H2, Windows 11 25H2, or Windows Server 2025 system.
2. Reconnoiter local privilege level, OS build, patch status, writable directories, scheduled-task behavior, and security controls.
3. Create or stage filesystem links, junctions, hard links, or reparse points that redirect privileged file access to an attacker-selected target.
4. Trigger the vulnerable Host Process for Windows Tasks code path or wait for the relevant Windows task-host operation to execute.
5. Abuse the privileged file access to modify, replace, or influence protected files or execution paths.
6. Obtain elevated local privileges, potentially administrator or SYSTEM-level execution.
7. Use the elevated context to dump credentials, disable defenses, establish persistence, or move laterally.

How to detect it

Look for evidence of local exploitation rather than network indicators, because this is a local privilege-escalation issue. Useful sources include EDR process telemetry, Windows Security logs, Sysmon logs, PowerShell logs, command-line auditing, file-system auditing, USN journal artifacts, scheduled task operational logs, and endpoint-management patch inventory. Focus on sequences where a low-privileged user creates symbolic links, junctions, hard links, or reparse points shortly before taskhostw.exe or another privileged Windows process accesses protected paths, followed by privilege changes, new services, suspicious scheduled tasks, credential dumping, or security-control tampering. Review Windows Security events for new service creation, special-privilege assignment, process creation if enabled, and account logon activity around the suspected time. In Sysmon, correlate Event ID 1 process creation, Event ID 11 file creation, Event ID 12/13/14 registry changes, Event ID 15 file stream creation, and Event ID 22 DNS queries with link-creation commands and unexpected child processes. Because the named threat context provided is generic rather than a distinct actor, detection should emphasize behavioral patterns associated with Windows link-following privilege escalation. Indicators such as mklink, fsutil hardlink, unusual use of junction/reparse-point tooling, and taskhostw.exe activity are suspicious only when correlated with privilege escalation, protected path modification, or other post-exploitation behavior.

• taskhostw.exe
• mklink
• mklink /D
• mklink /J
• fsutil hardlink create
• fsutil reparsepoint
• New-Item -ItemType SymbolicLink
• New-Item -ItemType Junction
• cmd.exe /c mklink
• powershell.exe -Command New-Item -ItemType SymbolicLink
• powershell.exe -Command New-Item -ItemType Junction
• Sysmon Event ID 1: Process Create
• Sysmon Event ID 11: FileCreate
• Sysmon Event ID 12: RegistryEvent ObjectCreate
• Sysmon Event ID 13: RegistryEvent ValueSet
• Windows Security Event ID 4688
• Windows Security Event ID 4672
• Windows Security Event ID 7045
• Microsoft-Windows-TaskScheduler/Operational
• \??\
• \GLOBAL??\

What your security team should do

• Treat this as urgent because it is CISA KEV-listed and marked as actively exploited in the wild; track remediation against the 2026-04-27 KEV due date or a more aggressive internal SLA.
• Patch Windows 11 24H2, Windows 11 25H2, and Windows Server 2025 systems with the latest applicable Microsoft cumulative security update.
• Prioritize systems where standard users, contractors, developers, service accounts, or untrusted workloads can execute code locally.
• Hunt for suspicious local privilege-escalation behavior involving taskhostw.exe, reparse points, junctions, hard links, unusual file writes to protected locations, and unexpected elevation shortly after link creation.
• Review EDR telemetry for low-privileged processes spawning command shells, PowerShell, or administrative tools immediately before SYSTEM- or administrator-level process creation.
• Limit local administrator rights and interactive logon rights, especially on servers and administrative workstations.
• Ensure tamper protection, credential theft protections, and attack surface reduction rules are enabled where available.
• After patching, rescan assets and produce evidence of compliance for KEV tracking and audit purposes.