← CVE Radar
CVE-2025-60710Host Process for Windows Tasks Elevation of Privilege Vulnerability
Improper link resolution before file access ('link following') in Host Process for Windows Tasks allows an authorized attacker to elevate privileges locally.
7.8 HIGHEPSS 4.61%⚡ Known Exploited (CISA KEV)NVD: Analyzed
Overview
Severity
| Score | Severity | Version | Vector String |
|---|---|---|---|
| 7.8 | HIGH | 3.1microsoft (CNA) | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| 7.8 | HIGH | 3.1microsoft (CNA) | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
CISA required action
⚡ Known exploited · remediation due Apr 27, 2026
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Details
- CVE ID
- CVE-2025-60710
- Status
- Analyzed
- Assigner (CNA)
- microsoft
- Published
- Nov 11, 2025
- Last modified
- 2026-10-18 21:10 UTC
- Weaknesses
- CWE-59 · Improper Link Resolution Before File Access ('Link Following')
Affected Products
As published by the CNA in the CVE record.
MicrosoftWindows 11 Version 24H21 version range
- 10.0.26100.0 before 10.0.26100.7462
MicrosoftWindows 11 Version 25H21 version range
- 10.0.26200.0 before 10.0.26200.7462
MicrosoftWindows Server 20251 version range
- 10.0.26100.0 before 10.0.26100.7462
MicrosoftWindows Server 2025 (Server Core installation)1 version range
- 10.0.26100.0 before 10.0.26100.7462
References
- msrc.microsoft.com https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-60710
- vicarius.io https://www.vicarius.io/vsociety/posts/cve-2025-60710-detection-script-eop-vulnerability-in-host-process-for-windows-tasks
- vicarius.io https://www.vicarius.io/vsociety/posts/cve-2025-60710-mitigation-script-eop-vulnerability-in-host-process-for-windows-tasks
- cisa.gov https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-60710