What Changed
CISA has flagged CVE-2025-60710, a Windows Task Host flaw, as known to be used in ransomware attacks. The update came in Friday’s change to the Known Exploited Vulnerabilities (KEV) catalog. The bug is a link-following issue that lets a local attacker escalate to SYSTEM on Windows 11 and Windows Server 2025. Microsoft patched it in November 2025.
The flaw has been in KEV since April 13, when CISA gave federal agencies two weeks to patch. Microsoft had not updated its advisory to reflect the new exploitation status when this was reported.
Why This Is An Operations Problem
Ransomware operators need SYSTEM privileges to disable security tools, dump credentials and deploy encryptors. A reliable local escalation bug on current Windows versions is a valuable part of that chain, even though it does not provide initial access.
Know what matters before your first meeting.
Weekday mornings. Five minutes. What changed in security, why it matters.
By subscribing you agree to our Privacy Policy.
Free. Weekday mornings. 5 minutes or less.
BleepingComputer’s count shows how common this pattern is: since November 2021, CISA has listed 383 exploited Microsoft vulnerabilities in KEV, and 112 of them are flagged as used in ransomware attacks.
What To Verify First
- Confirm the November 2025 security updates are installed on every Windows 11 and Windows Server 2025 system.
- Look for systems where updates have been deferred or failed since late 2025.
- Check EDR alerts for privilege escalation to SYSTEM followed by attempts to tamper with security tools.
- Monitor the KEV catalog’s ransomware flag in vulnerability management, not only the KEV listing itself.
What Teams May Be Underestimating
A ten-month-old patch can feel like a closed issue. The ransomware flag means attackers are actively using machines that missed it, and those tend to be the systems least likely to be watched.
Source Context
This item was rebuilt from the following primary sources and original reporting:
Related In The Daily Brief
See this item in The 5-Minute Cyber Brief
Newer CyberExperts coverage on this topic
This article still works as background. If you want the current picture, start with the freshest related coverage below and today's brief.
Coder’s registry infrastructure compromised to push malicious modules
The Coder incident is a supply-chain lesson in miniature: once attackers can tamper with trusted module distribution, defenders are no longer verifying...
Attackers Turn Trusted Node.js Runtime Into Malware Delivery Tool in Targeted Attacks
The useful lesson in this campaign is not that Node.js is bad. It is that adversaries keep choosing legitimate runtimes defenders already...
HPE patches critical ArubaOS-CX remote code execution flaw
ArubaOS-CX deserves attention because switching software rarely gets treated with the same urgency as identity or edge security until exploitation arrives. A...
Monday’s brief: GlobalProtect logins without passwords, then SonicWall, AhsayCBS and NetScaler
The fastest way to catch up on what changed after this article was published.
Start your morning with the signal that matters.
Get the biggest cybersecurity developments, why they matter, and where to go deeper on CyberExperts.
By subscribing you agree to our Privacy Policy.
Free. Weekdays. Built for operators.
