CVE-2025-60710 - PatchNow

📋 Vulnerability Details

Data Source: CIRCL

Confidence: HIGH

Exploitation Method: OTHER

CVE Published: 2025-11-11

Added to CISA KEV: 2026-04-13 153 DAYS BETWEEN CVE AND KEV

🎯 Recommendations:

CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review logs, check for unauthorized access, verify system integrity
Apply Microsoft security updates immediately (versions 10.0.26100.7462+ for Server 2025/Win11 24H2, 10.0.26200.7462+ for Win11 25H2)
Monitor for unusual privilege escalation activities in Windows event logs
Review user accounts and permissions for unauthorized elevation
Implement principle of least privilege to limit impact of successful exploitation
Priority: HIGH for all affected systems due to active exploitation

🔍 Web Intelligence (Kagi · 2026-06-04)

CVE-2025-60710 is a high-severity local privilege escalation vulnerability affecting Microsoft Windows, specifically involving the `\Microsoft\Windows\WindowsAI\Recall\PolicyConfiguration` scheduled task ^[1] ^[7].

Active Exploitation and Threat Actor Usage

Status: The vulnerability is confirmed to be actively exploited in the wild ^[5] ^[4].
CISA Involvement: The Cybersecurity and Infrastructure Security Agency (CISA) has flagged this flaw as being exploited in attacks ^[4].
Campaigns: While specific threat actor attribution is not detailed in public reports, its nature as a local privilege escalation (LPE) makes it a common target for attackers who have already gained initial access to a machine and wish to elevate their privileges to SYSTEM level ^[2].

Attack Method and Requirements

Method: The vulnerability is caused by "improper link resolution before file access" (a "link following" weakness) in the Host Process for Windows Tasks ^[3] ^[4].
Requirements:

* Access: It is a local vulnerability, meaning an attacker must already have authorized access to the system to execute the exploit ^[3] ^[2]. * User Interaction: Generally, LPE exploits of this nature do not require complex user interaction once the attacker has established a foothold.

Impact and Access

Impact: Successful exploitation allows an attacker to elevate their privileges to SYSTEM level ^[2].
Capabilities: It specifically enables arbitrary folder deletion with SYSTEM privileges, which can be leveraged to further compromise the system or bypass security controls ^[6].

Proof-of-Concept (PoC) Availability

Availability: Yes, a proof-of-concept exploit is publicly available on GitHub, specifically targeting the `\Microsoft\Windows\WindowsAI\Recall\PolicyConfiguration` scheduled task ^[1].

Affected Products and Patch Status

Affected Products: The vulnerability affects Windows 11 and Windows Server 2025 ^[4].
Patch Status: The vulnerability was patched by Microsoft approximately five months prior to April 2026 ^[5]. Users are strongly advised to ensure their systems are fully updated to the latest security patches.

Sources

Microsoft Windows: CVE-2025-60710 - Rapid7 Vulnerability Database
Improper link resolution before file access ('link following') in Host Process for Windows Tasks allows an authorized attacker to elevate privileges locally ...
redpack-kr/CVE-2025-60710 - GitHub
CVE-2025-60710. This is PoC for local privilege escalation vulnerability in \Microsoft\Windows\WindowsAI\Recall\PolicyConfiguration scheduled task. When this ... CVE-2025-60710 This is PoC for local privilege escalation vulnerability in \Microsoft\Windows\WindowsAI\Recall\PolicyConfiguration schedul…
CVE-2025-60710 Detail - NVD
Description. Improper link resolution before file access ('link following') in Host Process for Windows Tasks allows an authorized attacker to elevate ...
CISA flags Windows Task Host vulnerability as exploited in attacks
Tracked as CVE-2025-60710, this Windows security flaw stems from a link following weakness affecting Windows 11 and Windows Server 2025 ...
CVE-2025-60710 Windows Privilege Escalation Flaw Exploited
A Windows privilege escalation flaw patched five months ago is now confirmed to be actively exploited. CVE-2025-60710 (CVSS .78) affects ...
Wh04m1001/CVE-2025-60710 | DeepWiki
CVE-2025-60710 is a local privilege escalation vulnerability in the Windows \Microsoft\Windows\WindowsAI\Recall\PolicyConfiguration scheduled task that allows arbitrary folder deletion with SYSTEM privileges.
CVE-2025-60710 | Microsoft Windows Vulnerability | UpGuard
CVE-2025-60710 is a high-severity local privilege escalation vulnerability in Windows Task Scheduler being actively exploited in the wild.

🟢 CVE-2025-60710