High 7.8
KEV + Ransomware
CVE-2025-60710
CISA confirms Windows Task Host flaw exploited by ransomware gangs
Vendor / product: Windows Task Host
Event date: 2026-04-13
Public PoC: Yes
First tracked by RiskWire: 2026-08-18
CISA KEV catalog
Added to KEV
Federal remediation due
2026-04-27 (146 days overdue)
Ransomware campaign use
Known
CISA description
Microsoft Windows contains a link following vulnerability that allows for privilege escalation
Required action
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Sources & citations (3)
- CISA: Windows Task Host flaw now exploited by ransomware gangs bleepingcomputer.com · 2026-08-18
- CISA Confirms Windows Task Host Flaw Used in Ransomware Attacks windowsreport.com · 2026-08-18
- CISA confirms 2025 Windows Task Host flaw exploited by ransomware groups scworld.com · 2026-08-18
References
See CVE-2025-60710 in context
RiskWire tracks every exploited CVE this week, cross-referenced against CISA KEV with federal remediation deadlines. Filtered to your vendor stack.
Book a 20-min demo →