CVE-2025-60710
Microsoft Windows Link Following Vulnerability
Description
CVE-2025-60710 is a HIGH-severity link following (symlink) vulnerability in the Host Process for Windows Tasks component of Microsoft Windows 11 and Windows Server 2025, carrying a CVSS 3.1 score of 7.8. An authorized local attacker can abuse improper link resolution before file access to redirect privileged file operations to attacker-controlled targets, resulting in local elevation of privilege. The flaw affects Windows 11 24H2, Windows 11 25H2, and Windows Server 2025 prior to the November 2025 security update and is tracked in CISA's Known Exploited Vulnerabilities (KEV) catalog with a federal remediation deadline of April 27, 2026. With an EPSS score of 0.17969 (95.2nd percentile), CVE-2025-60710 exhibits a substantially elevated likelihood of exploitation and should be prioritized in patch cycles.
KEV Information
CVSS Score
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| microsoft | windows 11 24h2 | < 10.0.26100.7392 |
| microsoft | windows 11 25h2 | < 10.0.26200.7392 |
| microsoft | windows server 2025 | < 10.0.26100.7392 |
References
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-60710(Vendor Advisory)
- https://www.vicarius.io/vsociety/posts/cve-2025-60710-detection-script-eop-vulnerability-in-host-process-for-windows-tasks(Third Party Advisory)
- https://www.vicarius.io/vsociety/posts/cve-2025-60710-mitigation-script-eop-vulnerability-in-host-process-for-windows-tasks(Mitigation, Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-60710(US Government Resource)
Weakness Type
CWE-59: Improper Link Resolution Before File Access ('Link Following')
CVE-2025-60710 is classified as CWE-59, a link following weakness in which the Host Process for Windows Tasks accesses a file through a path that an attacker can manipulate via symbolic links, hard links, or junctions. Because the privileged Windows task host does not sufficiently validate that the resolved path points to an intended, authorized location, a low-privileged user can redirect write or delete operations to sensitive system files and thereby escalate to higher privileges.
Learn more: CWE-59 — Improper Link Resolution Before File Access ('Link Following')
Impact Analysis
CVE-2025-60710 carries a CVSS 3.1 base score of 7.8 (HIGH) with the vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, meaning the vulnerability is locally exploitable by an attacker who already has low-level privileges on the target host, requires no user interaction, and has low attack complexity once the attacker can invoke the Host Process for Windows Tasks. The Scope is Unchanged, so exploitation is contained within the vulnerable Windows component, but the Confidentiality, Integrity, and Availability impacts are all rated HIGH because a successful privilege escalation on Windows 11 or Windows Server 2025 typically yields SYSTEM-level access that can read arbitrary files, modify system configuration, and disable security controls. With an EPSS score of 17.97% (95.2nd percentile) and confirmed listing in CISA's KEV catalog, active exploitation is considered highly likely, and any initial-access foothold on an unpatched Windows 11 or Server 2025 host should be treated as a probable path to full machine compromise.
Exploit Maturity
CVE-2025-60710 is listed in CISA's Known Exploited Vulnerabilities catalog (added 2026-04-13), which confirms that active in-the-wild exploitation has been observed against Microsoft Windows link-following weaknesses tracked under this identifier. Public tooling is available: Vicarius has published both a detection script and a mitigation script that describe the vulnerability surface in enough detail to aid both defenders and exploit developers. The EPSS score of 17.97% (95.2nd percentile) places CVE-2025-60710 in the top 5% of tracked vulnerabilities by exploitation likelihood, and while CISA has not flagged a known ransomware association at this time, local elevation-of-privilege flaws like this are routinely chained with phishing, malicious attachments, and remote-code-execution foot-holds to convert user-level compromise into full domain or host takeover. Defenders should assume weaponized exploit code is in circulation and prioritize patching ahead of the 2026-04-27 KEV deadline.
Remediation
- Apply the Microsoft security update immediately. Per CISA's required action for CVE-2025-60710, apply mitigations per vendor instructions and meet the BOD 22-01 remediation deadline of 2026-04-27. Install the November 2025 (or later) cumulative update that raises Windows 11 24H2 / Server 2025 to build 10.0.26100.7392 or higher, and Windows 11 25H2 to 10.0.26200.7392 or higher, per the Microsoft Security Response Center advisory.
- Inventory affected builds. Use Microsoft Configuration Manager, Intune, or your endpoint management platform to enumerate all Windows 11 24H2, Windows 11 25H2, and Windows Server 2025 systems and confirm their build numbers against the fixed versions listed above.
- Apply the Vicarius interim mitigation where patching is delayed. Vicarius has published a mitigation script for CVE-2025-60710 that can be deployed as a temporary compensating control while updates are tested and rolled out.
- Restrict local logon and limit standard-user write access in shared directories. Because CVE-2025-60710 requires local, authenticated access, tightening interactive logon rights on servers, removing unnecessary standard-user sessions, and auditing NTFS permissions on directories writable by low-privileged users reduces the pool of potential attackers.
- Hunt for link-abuse indicators. Deploy the Vicarius detection script for CVE-2025-60710 and review Windows event logs, Sysmon (Event ID 11 file-create, Event ID 15 file-stream), and EDR telemetry for suspicious symbolic link, junction, or hard-link creation by non-administrative users targeting system paths.
- Harden against link-following in the long term. Enforce the CWE-59 guidance of opening files via handles rather than reopening by path, enable protected mode for privileged services where supported, and keep Windows Defender Attack Surface Reduction rules that block credential and LSASS abuse enabled to contain post-exploitation actions.
Technical Details
CVE-2025-60710 originates in the Host Process for Windows Tasks (taskhostw.exe / svchost surrogate), which performs file operations on behalf of scheduled or system tasks. The component resolves file paths without adequately checking whether intermediate directory entries or target files are symbolic links, hard links, or NTFS junctions controlled by a lower-privileged user — the classic CWE-59 link-following pattern. A local attacker who can plant a crafted link in a path the task host later accesses is able to redirect a privileged read, write, or delete operation to a sensitive system object such as a configuration file, DLL, or registry-backed hive, which ultimately produces an elevation of privilege to the context under which the task host runs. The CVSS 3.1 vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H confirms the exploitation profile: local attack vector, low complexity (attackers need only file-system write access in a directory the privileged task host touches), low privileges required (any authenticated user), no user interaction, and high impact on confidentiality, integrity, and availability because SYSTEM-level file operations can be redirected arbitrarily. The vulnerability affects Windows 11 24H2 prior to 10.0.26100.7392, Windows 11 25H2 prior to 10.0.26200.7392, and Windows Server 2025 prior to 10.0.26100.7392.
Frequently Asked Questions
Is CVE-2025-60710 being actively exploited?
Yes. CVE-2025-60710 was added to CISA's Known Exploited Vulnerabilities catalog on 2026-04-13, which confirms observed in-the-wild exploitation, and its EPSS score of 17.97% (95.2nd percentile) places it in the top 5% of vulnerabilities by exploitation likelihood. CISA has not flagged a known ransomware association at this time, but local privilege-escalation flaws like this one are commonly chained after initial access.
What products are affected by CVE-2025-60710?
CVE-2025-60710 affects Microsoft Windows 11 24H2 before build 10.0.26100.7392, Windows 11 25H2 before 10.0.26200.7392, and Windows Server 2025 before 10.0.26100.7392. Organizations should inventory these SKUs and confirm every endpoint and server has received the November 2025 (or later) cumulative update.
How do I fix CVE-2025-60710?
Install Microsoft's security update for the Host Process for Windows Tasks as documented in the MSRC advisory, which raises affected builds to the fixed versions listed above, and meet CISA's BOD 22-01 remediation deadline of 2026-04-27. Where patching is delayed, deploy the Vicarius mitigation script as an interim control and hunt for suspicious symlink, hard-link, or junction creation by non-administrative users.
How severe is CVE-2025-60710?
CVE-2025-60710 is rated HIGH with a CVSS 3.1 base score of 7.8, and its 95.2nd-percentile EPSS ranking indicates near-certain interest from attackers. Because successful exploitation yields local elevation of privilege with HIGH impact on confidentiality, integrity, and availability, unpatched Windows 11 and Server 2025 systems should be treated as a significant post-compromise risk.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.