Windows Task Host Privilege Escalation Vulnerability Under Active Attack

CVE-2025-60710 represents a critical privilege escalation flaw in Windows Task Host that allows attackers with basic user access to gain SYSTEM-level privileges and complete control over affected systems. The vulnerability affects Windows 11 and Windows Server 2025, highlighting how core operating system components can become attack vectors when not properly secured. CISA's urgent directive to federal agencies demonstrates the severity of this actively exploited vulnerability and the critical importance of rapid patch deployment. Organizations that delay patching face immediate risk of complete system compromise through privilege escalation attacks.

Tactical Insight

Immediate actions

Apply Microsoft security updates for CVE-2025-60710 to all Windows 11 and Windows Server 2025 systems immediately
Conduct emergency scanning to identify all affected systems in the environment
Implement additional monitoring for privilege escalation activities on unpatched systems

Long-term improvements

Establish automated patch management processes with emergency deployment capabilities
Maintain comprehensive asset inventory to ensure complete patch coverage
Implement principle of least privilege to limit impact of potential privilege escalation attacks

Detection measures

Monitor for suspicious SYSTEM-level process creation from standard user accounts
Enable detailed logging of privilege changes and authentication events
Deploy endpoint detection tools capable of identifying privilege escalation techniques