Which products and versions are affected by CVE-2025-60710?

Affected: windows 11 24H2 (Microsoft); windows 11 25H2 (Microsoft); Windows Server 2025 (Microsoft) versions >= 10.0.26100.0, among others. The full list is in the CVE brief.

Is CVE-2025-60710 being exploited in the wild?

It is exploited in the wild, listed in CISA KEV, Industry KEV feed, CIRCL KEV, ENISA EUVD since Apr 13, 2026 and is known to be used in ransomware campaigns.

Is CVE-2025-60710 in the CISA KEV catalog?

Yes. It was added on Apr 13, 2026 with a federal remediation due date of Apr 27, 2026.

Is there a public exploit for CVE-2025-60710?

Public exploit code is available.

Is there a fix for CVE-2025-60710?

Fixed versions are available, including windows 11 24H2 10.0.26100.7392, windows 11 24H2 10.0.26100.7462, windows 11 25H2 10.0.26200.7392.

How urgently should CVE-2025-60710 be patched?

Brandefense priority: patch immediately, because it is listed as exploited in the wild.

Request A Demo

Vulnerability Intelligence

CVE-2025-60710

HighExploitedPublic exploit

Host Process for Windows Tasks Elevation of Privilege Vulnerability

Published Nov 10, 2025 · Updated Aug 15, 2026

Key Facts

Patch immediately

CVE-2025-60710 is a high-severity vulnerability (CVSS 7.8 v3.1) affecting windows 11 24H2 (Microsoft), windows 11 25H2 (Microsoft), Windows Server 2025 (Microsoft) and 3 more products.
It is exploited in the wild, listed in CISA KEV, Industry KEV feed, CIRCL KEV, ENISA EUVD since Apr 13, 2026 and is known to be used in ransomware campaigns. Public exploit code is available.
EPSS estimates a 4.6% probability of exploitation in the next 30 days.
Fixed versions are available, including windows 11 24H2 10.0.26100.7392, windows 11 24H2 10.0.26100.7462, windows 11 25H2 10.0.26200.7392.
Brandefense priority: patch immediately, because it is listed as exploited in the wild.

CVSS v3.1

7.8

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS (30-day exploit likelihood)

4.6%

Higher than 91.5% of all scored CVEs

Exploited in the wild

Yes

4 catalog listings, used by ransomware

Public exploit code

Available

Proof-of-concept or weaponized module

Get the full CVE-2025-60710 brief as a PDF

Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.

Description

Improper link resolution before file access ('link following') in Host Process for Windows Tasks allows an authorized attacker to elevate privileges locally.

Known-Exploited Catalog Listings

Catalog	Added	Remediation due	Ransomware use
CISA KEV	Apr 13, 2026	Apr 27, 2026	Known
Industry KEV feed	Apr 13, 2026	Apr 27, 2026	Known
CIRCL KEV	Apr 13, 2026	Apr 27, 2026	Not reported
ENISA EUVD	Apr 13, 2026	n/a	Not reported

Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Affected Products

9 affected entries in total

Product	Affected versions	Fixed in
windows 11 24H2Microsoft	See advisory	10.0.26100.7392
windows 11 25H2Microsoft	See advisory	10.0.26200.7392
Windows Server 2025Microsoft	>= 10.0.26100.0	10.0.26100.7392
Windows 11 Version 24H2	>= 10.0.26100.0	10.0.26100.7462
Windows 11 Version 25H2	>= 10.0.26200.0	10.0.26200.7462

1 more affected products in the full CVE brief

Patched Releases

windows 11 24H2

10.0.26100.7392, 10.0.26100.7462

windows 11 25H2

10.0.26200.7392, 10.0.26200.7462

Windows Server 2025

10.0.26100.7392, 10.0.26100.7462

Windows 11 Version 24H2

10.0.26100.7462

Windows 11 Version 25H2

10.0.26200.7462

Windows Server 2025 (Server Core installation)