CISA: Windows Task Host Vulnerability Now in the Ransomware Playbook

The US Cybersecurity and Infrastructure Security Agency (CISA) has reported that a vulnerability in the Windows Task Host system component is now being used by the groups behind ransomware operations. The flaw had already been flagged as actively exploited back in April.

Task Host is a core Windows component that allows DLL-based processes to run in the background and shut down properly when the system powers off, preventing data corruption.

What we know about the vulnerability

The vulnerability has been assigned the identifier CVE-2025-60710. It is a privilege-escalation flaw tied to a “link following” weakness. It affects Windows 11 and Windows Server 2025. Microsoft closed it with an update in November 2025.

On successful exploitation, a local attacker with basic user rights can obtain SYSTEM-level privileges and full control over an unpatched device.

CISA's response

CISA is not disclosing details of the current attacks, and Microsoft has yet to update its security advisory to confirm exploitation “in the wild.” Even so, back on April 13 the agency added CVE-2025-60710 to its catalog of actively exploited vulnerabilities and gave federal civilian agencies two weeks to secure their systems.

This past Friday, CISA again updated its Known Exploited Vulnerabilities (KEV) catalog, noting that the vulnerability is now being used by ransomware operators. The agency likewise offered no details about specific attacks, and a Microsoft spokesperson was unavailable for comment when BleepingComputer journalists reached out.

“Vulnerabilities of this type are a frequent attack vector for malicious actors and pose a significant risk to federal infrastructure,” the agency warned. CISA recommends applying protective measures in line with the vendor's instructions, following the guidance in BOD 22-01 for cloud services, or discontinuing use of the product if fixes are not available.

The trend

A week earlier, CISA had warned that ransomware operators had begun exploiting a remote code execution vulnerability in Microsoft SharePoint (CVE-2026-45659) — its active exploitation was confirmed in early July.

Since November 2021, the agency has flagged 383 actively exploited vulnerabilities across various Microsoft products, 112 of which have also been used in ransomware attacks.

Source: Bleeping Computer