A Critical Windows Flaw is Now Being Exploited by Ransomware Gangs, CISA Warns
The US Cybersecurity and Infrastructure Security Agency (CISA) has confirmed that a previously patched high-severity vulnerability in Windows Task Host is being exploited by ransomware gangs. This flaw, tracked as CVE-2025-60710, allows attackers to gain SYSTEM privileges and take control of unpatched devices. If left unchecked, this could have disastrous consequences for organizations that rely on these systems.
Task Host is a core component of the Windows operating system, responsible for running DLL-based processes in the background and preventing data corruption during shutdowns. However, researchers discovered a link following weakness in Task Host that affects Windows 11 and Windows Server 2025 devices. This vulnerability was patched by Microsoft back in November 2025, but it appears that some attackers have already begun exploiting it.
CISA first flagged this flaw as actively exploited on April 13, adding it to their list of known exploited vulnerabilities. At the time, the agency warned federal agencies to secure their systems within two weeks, citing the high risk posed by this vulnerability. Now, CISA has updated its Known Exploited Vulnerabilities Catalog (KEV) to reflect that ransomware gangs are indeed exploiting CVE-2025-60710.
While CISA has not released any details about specific attacks targeting this vulnerability, it’s clear that many organizations may still be vulnerable. The agency emphasized the importance of applying mitigations per vendor instructions or discontinuing use of affected products if no mitigations are available. This warning highlights the ongoing threat posed by unpatched vulnerabilities and the need for organizations to stay vigilant.
It’s worth noting that this is not an isolated incident – CISA has been tracking numerous actively exploited vulnerabilities in various Microsoft products, with over 380 flagged since November 2021. Many of these have been exploited in ransomware attacks, underscoring the importance of staying up-to-date on patches and security updates.
In light of this warning, it’s essential for organizations to review their security posture and ensure they are taking all necessary steps to protect against CVE-2025-60710 and other known exploited vulnerabilities. This includes applying available patches, implementing robust security measures, and regularly reviewing system logs for signs of suspicious activity. By staying proactive, organizations can minimize the risk of falling victim to ransomware attacks and maintain a secure digital environment.
Source: Bleeping Computer — 2026-08-18