Ransomware gangs now exploit a Windows Task Host flaw to gain SYSTEM

CISA confirmed that ransomware groups are now exploiting a Windows Task Host privilege-escalation flaw that has been flagged as actively exploited since April. Tracked as CVE-2025-60710 and scored 7.8, it is a link-following weakness in the component that runs background scheduled tasks as SYSTEM: a local attacker with only basic user rights can use a junction on a user-writable path to make a SYSTEM-level task act on files it should not, escalating to full control. Microsoft patched it in November 2025, and it affects Windows 11 and Server 2025. Privilege escalation like this is exactly what ransomware operators need to disable defenses and spread after gaining an initial foothold.

Check

Confirm the November 2025 update for this flaw is deployed across Windows 11 and Windows Server 2025 systems, prioritizing any that still lack it, since ransomware crews are now using it.

Affected

Windows 11 and Windows Server 2025 systems missing the November 2025 patch (CVE-2025-60710); a local attacker with basic rights can escalate to SYSTEM, and ransomware groups are actively exploiting it.

Fix

Apply the patch, prioritize privilege-escalation fixes in your patching since they enable ransomware to spread, monitor for junction abuse and unexpected SYSTEM-level file operations, and limit local footholds through least privilege.