Ransomware Crews Exploit Windows Task Host Flaw for SYSTEM Access

On August 21, 2026, CISA’s current Known Exploited Vulnerabilities entry marks a patched Windows Task Host flaw as known to be used in ransomware campaigns. That ransomware designation is the new reason to revisit CVE-2025-60710, which CISA first added to the catalog in April.

The vulnerability affects Windows 11 versions 24H2 and 25H2 and Windows Server 2025, including Server Core. It does not give an attacker initial remote access. A low-privilege attacker who can already operate on the system can exploit the link-following error to reach SYSTEM privileges.

CISA now links ransomware

CISA describes CVE-2025-60710 as a Windows link-following vulnerability that allows privilege escalation. Its catalog now answers “Known” to whether the flaw has been used in ransomware campaigns. BleepingComputer reported that CISA changed that field on Friday.

The public record stops there. CISA has not named a ransomware group, described an intrusion sequence, identified victims, or quantified the number of incidents. The catalog establishes exploitation and ransomware use. It does not establish that the flaw delivered the first foothold or that every attempt ended in encryption.

Microsoft’s advisory still preserves its earlier exploit assessment from the original November 2025 release. The two records reflect different points in time: Microsoft documents the vulnerability and remediation, while CISA supplies the later exploitation status.

The flaw converts local access

Microsoft describes the root cause as improper link resolution before file access in Host Process for Windows Tasks. The component performs a privileged filesystem operation without safely resolving the link target. A low-privilege user can redirect that operation toward another location and make the trusted process act with SYSTEM authority.

The vulnerable surface includes the scheduled task at:

\Microsoft\Windows\WindowsAI\Recall\PolicyConfiguration

That path is operationally useful on Windows Server 2025 with Desktop Experience because Microsoft names the task in its temporary workaround. It is not an indicator of compromise by itself. A normal system can contain the task, and Server Core is affected even though Microsoft’s task-disabling workaround is scoped to Desktop Experience.

The consequence is unambiguous. Microsoft’s advisory says, “An attacker who successfully exploited this vulnerability could gain SYSTEM privileges.” That turns a constrained local account or earlier code-execution foothold into the operating system’s highest routine privilege level. From there, ransomware operators can interfere with defenses, access protected data, deploy payloads, and act across the host under SYSTEM, although CISA has not published which of those actions it observed for this CVE.

Two source-backed chains show the Windows Task Host privilege path and the defender proof needed to address it.

Figure details

The upper chain begins with an existing low-privilege local foothold. Host Process for Windows Tasks follows a filesystem link during a privileged operation, and successful exploitation yields SYSTEM privileges. The lower defender chain starts by identifying Windows 11 24H2 or 25H2 and Windows Server 2025 systems, verifies the comprehensive fixed build or the applicable hotpatch, and then reviews telemetry for SYSTEM activity that could predate remediation. CISA confirms ransomware use but names no ransomware group, victim count, or CVE-specific indicators.

Public evidence leaves attribution open

CISA’s ransomware flag makes patch status an incident-priority signal, but it is not a campaign-specific detection package. The agency has published no hashes, filenames, domains, IP addresses, registry keys, or command lines for the activity. Defenders cannot use the KEV entry alone to attribute a process tree or a ransom event to CVE-2025-60710.

Recognition starts with the causal order. The exploit needs a local foothold with low privileges, a link-following action by Host Process for Windows Tasks, and a resulting privileged effect. On systems with process-creation telemetry, review taskhostw.exe activity and SYSTEM-level child processes around suspicious low-privilege sessions. Treat that as scoping context because Microsoft and CISA have not published a CVE-specific process signature.

The scale remains unknown. Windows 11 and Server 2025 create a broad potential product surface, but neither primary source says how many vulnerable devices were exposed or how many ransomware incidents used the flaw. The supported conclusion is narrower: exploitation is confirmed, ransomware use is known, and the public campaign details are absent.

Verify the comprehensive fix

Microsoft first shipped an update in November 2025, then revised the advisory to say the December security updates comprehensively address CVE-2025-60710. The regular cumulative path is KB5072033: build 26100.7462 for Windows 11 24H2 and Windows Server 2025, and build 26200.7462 for Windows 11 25H2. KB5072033 supersedes KB5068861. Later cumulative updates supersede KB5072033 and remain valid when their build is newer.

Microsoft also lists security hotpatch KB5072014, builds 26100.7392 and 26200.7392, which supersedes KB5068966 for the applicable hotpatch products. Confirm that a device is actually on the hotpatch servicing path before treating those lower build numbers as sufficient.

Inventory the product and build with PowerShell:

$os = Get-CimInstance Win32_OperatingSystem
[pscustomobject]@{
  Product = $os.Caption
  Version = $os.Version
  Build   = $os.BuildNumber
}

The expected result on the regular cumulative path is Windows 11 24H2 or Server 2025 at 26100.7462 or later, or Windows 11 25H2 at 26200.7462 or later. Validate the edition and servicing channel as well as the numeric build.

For an unpatched Server 2025 Desktop Experience host, Microsoft says administrators can temporarily disable \Microsoft\Windows\WindowsAI\Recall\PolicyConfiguration. Re-enable it after installing the comprehensive update. Check its current state with:

Get-ScheduledTask `
  -TaskPath '\Microsoft\Windows\WindowsAI\Recall\' `
  -TaskName 'PolicyConfiguration' |
  Select-Object TaskPath, TaskName, State

Patch proof answers exposure; retained telemetry answers compromise. A compliant build should remove the vulnerable condition, while an incident review still has to account for the low-privilege foothold, the privileged transition, and subsequent SYSTEM activity. CISA’s ransomware designation raises the urgency of both checks without supplying the history of any individual host.

1-minute read

CISA’s current KEV entry says CVE-2025-60710 is known to be used in ransomware campaigns. The Windows Task Host link-following flaw affects Windows 11 24H2 and 25H2 and Windows Server 2025, including Server Core. It requires an existing low-privilege foothold, then allows elevation to SYSTEM.

Microsoft says the December 2025 updates comprehensively address the flaw. The regular cumulative fix is KB5072033: build 26100.7462 for Windows 11 24H2 and Server 2025, and 26200.7462 for Windows 11 25H2. Later cumulative updates supersede that package. Applicable hotpatch devices use KB5072014 at builds 26100.7392 or 26200.7392.

Inventory the product, edition, servicing channel, and OS build. On the regular cumulative path, expect 24H2 or Server 2025 at 26100.7462 or later, or 25H2 at 26200.7462 or later. Microsoft permits unpatched Server 2025 Desktop Experience hosts to disable \Microsoft\Windows\WindowsAI\Recall\PolicyConfiguration temporarily and re-enable it after patching.

CISA has not published ransomware groups, victims, scale, or CVE-specific indicators. Review taskhostw.exe and SYSTEM-level activity around suspicious low-privilege sessions as scoping context. Preserve process-creation, endpoint, account-logon, and update records long enough to correlate the local foothold with the privileged transition.

The scheduled task is normal configuration and does not prove compromise. Patch proof should show the expected product-specific build or a valid hotpatch channel. Incident proof should account for the initial foothold and every privileged follow-on action, including activity that predates remediation.