CVE-2025-60710

Microsoft Windows 11 Version 24H2, Microsoft Windows 11 Version 25H2, Microsoft Windows Server 2025

Published 11 Nov 2025 · updated 17 Jun 2026 · Analyzed

7.8 High · CVSS 3.1, microsoft.com

Exploited in the wild

CISA added this to its Known Exploited Vulnerabilities catalog on 13 Apr 2026, with a remediation deadline of 27 Apr 2026 for US federal agencies. It has been used in ransomware campaigns.

Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Description

Improper link resolution before file access ('link following') in Host Process for Windows Tasks allows an authorized attacker to elevate privileges locally.

References

msrc.microsoft.com/update-guide/vulnerability/CVE-2025-60710 · Vendor Advisory
www.vicarius.io/vsociety/posts/cve-2025-60710-detection-script-eop-vulnerability-in-host-process-for-windows-tasks · Third Party Advisory
www.vicarius.io/vsociety/posts/cve-2025-60710-mitigation-script-eop-vulnerability-in-host-process-for-windows-tasks · Mitigation, Third Party Advisory
www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-60710 · US Government Resource