Ransomware crews pick up the Windows Task Host bug Microsoft fixed in November

CISA has updated its Known Exploited Vulnerabilities catalog to mark CVE-2025-60710, a Windows Task Host privilege escalation flaw, as being abused by ransomware gangs ^[1][7]. Microsoft patched it in November 2025, so any Windows 11 or Windows Server 2025 host still exposed has had a fix available for months ^[3].

The mechanics are unglamorous, which is why this one will work. Task Host is a core Windows component that lets DLL-based processes run in the background and closes them cleanly at shutdown to prevent data corruption ^[2]. The bug is a link-following weakness in that component affecting Windows 11 and Server 2025 ^[3]. A local attacker with nothing more than basic user permissions can use it to gain SYSTEM privileges and take full control of an unpatched device ^[4]. That is not an entry point; it is the second move after one, the step that converts a phished session or a commodity loader into ownership of the machine.

The timeline matters. CISA added CVE-2025-60710 to KEV on April 13 and gave Federal Civilian Executive Branch agencies two weeks to remediate ^[5], a deadline that fell in late April ^[3] and roughly five months after the patch shipped ^[1]. Friday's update does not change what the bug does; it changes who is holding it ^[7]. Ransomware affiliates are the population that industrialises local privilege escalation, because they need SYSTEM on many hosts quickly rather than on one host quietly.

What is thin here should be stated plainly. CISA has published no details of the attacks it is describing ^[6][8]. Microsoft has not updated its security advisory to confirm exploitation in the wild ^[6], and a Microsoft spokesperson was not available for comment when BleepingComputer asked ^[9]. The ransomware attribution currently rests on CISA's catalogue entry and its standard guidance to apply vendor mitigations, follow BOD 22-01 for cloud services, or stop using the product if mitigations do not exist ^[10].

The base rate argues against treating this as exceptional. Since November 2021 the agency has flagged 383 actively exploited vulnerabilities in Microsoft products, 112 of which have also been used in ransomware attacks ^[11] - roughly 29 percent ^[2]. A week before this update, CISA said ransomware crews had begun exploiting a Microsoft SharePoint remote code execution flaw, CVE-2026-45659, which it had confirmed as actively exploited in early July ^[12]. The pattern is consistent: KEV listing first, ransomware annotation later, with the patch long since published.

Which puts the burden on verification rather than availability. If your November 2025 cumulative updates were approved, the question is not whether they were approved but which endpoints never took them: laptops that were offline through the window, servers deferred out of a maintenance ring, hosts imaged from media older than the fix, and anything built after the ring closed.

Watch for Microsoft updating the CVE-2025-60710 advisory to acknowledge in-the-wild exploitation ^[6], and for CISA or incident responders publishing any indicators, since none exist publicly yet ^[8]. In the meantime, treat local SYSTEM escalation alerts on Windows 11 and Server 2025 as ransomware precursors rather than noise.