CVE-2025-60710 is a Windows privilege escalation vulnerability in the Windows Task Host component caused by a link following weakness. It affects Windows 11 and Windows Server 2025. The flaw allows local attackers with basic user permissions to escalate privileges to SYSTEM level, enabling full control over unpatched devices. Microsoft patched the vulnerability in November 2025. CISA confirmed active exploitation by ransomware gangs as of April 2026 and included it in its Known Exploited Vulnerabilities Catalog, urging federal agencies to secure their systems within two weeks of notification.

Successful exploitation of CVE-2025-60710 enables local attackers to escalate privileges from basic user to SYSTEM level, granting full control over the affected Windows 11 and Windows Server 2025 systems. This significantly increases the risk of ransomware and other malicious activities on unpatched devices. The vulnerability is actively exploited by ransomware gangs, posing a substantial threat to organizations that have not applied the patch.

Microsoft released an official patch for CVE-2025-60710 in November 2025. Organizations should apply this update immediately to mitigate the risk. CISA recommends applying vendor-provided mitigations per official instructions and following applicable guidance such as BOD 22-01 for cloud services. If mitigations are unavailable, discontinuing use of the affected product is advised. Federal agencies were given a two-week deadline to secure systems following CISA's April 2026 advisory.