CVE-2025-60710: Microsoft Windows Link Following Vulnerability
Microsoft Windows contains a link following vulnerability that allows for privilege escalation
Overview
A link-following flaw in the Host Process for Windows Tasks on Windows 11 versions 24H2 and 25H2 and Windows Server 2025 allows a locally authenticated, low-privileged user to escalate privileges. By planting a symbolic link or directory junction at a path the privileged process accesses, an attacker redirects file operations to an arbitrary target, gaining read, write, or delete access with elevated rights. This vulnerability is actively exploited and has been associated with ransomware activity.
Vulnerability details
CWE-59 (Improper Link Resolution Before File Access) describes a class of flaw where a privileged process resolves a filesystem path without first confirming that the path has not been redirected through a symbolic link or directory junction. In Windows, the Host Process for Windows Tasks runs with elevated privileges and accesses specific filesystem paths as part of its normal operation. When it fails to validate whether a target path is a symlink or junction before performing file operations, a lower-privileged process can redirect those operations to an attacker-chosen location, causing the privileged process to act on files it was never intended to touch.
An attacker with a standard local user account plants a symbolic link or directory junction at a filesystem path that the Host Process for Windows Tasks will later access with elevated privileges. When the process follows the redirected path, it reads from, writes to, or deletes files at the attacker-controlled target with the elevated authority of that process, which the mechanism assesses as likely SYSTEM-level. This gives the attacker the ability to overwrite sensitive system files, plant malicious content in privileged locations, or destroy protected data. No user interaction is required beyond the initial symlink placement.
Severity and impact
Exploitation status
This vulnerability is confirmed as actively exploited in the wild — it is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog.
Detection and monitoring
- Monitor Windows Security audit logs for object access events (Event ID 4663) where the accessing process is taskhost.exe and the target object path falls outside expected task-related directories, particularly paths in user-writable locations.
- Look for junction or symlink creation events in user-writable directories shortly before taskhost.exe file-access events. On Windows, junction creation can be detected via filesystem filter drivers or endpoint detection tools that log CreateFile and FSCTL_SET_REPARSE_POINT calls from low-privileged processes.
Remediation
Additional hardening
- Update Windows 11 24H2 and Windows Server 2025 to build 10.0.26100.7462 or later, and Windows 11 25H2 to build 10.0.26200.7462 or later, as these are the first fixed releases per the vendor advisory.
- Restrict the ability of standard users to create symbolic links by auditing the SeCreateSymbolicLinkPrivilege assignment via Group Policy; directory junctions require no special privilege, so endpoint detection controls are also necessary.
- Apply least-privilege principles to limit interactive local logon access on servers and sensitive workstations, reducing the pool of accounts that could plant a symlink before the privileged process runs.
- Deploy an endpoint detection and response agent capable of logging reparse-point creation events and correlating them with subsequent privileged process file access, enabling rapid identification of exploitation attempts.
Key dates
References
- https://www.vicarius.io/vsociety/posts/cve-2025-60710-mitigation-script-eop-vulnerability-in-host-process-for-windows-tasks
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-60710
- https://nvd.nist.gov/vuln/detail/CVE-2025-60710
- https://www.vicarius.io/vsociety/posts/cve-2025-60710-detection-script-eop-vulnerability-in-host-process-for-windows-tasks
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-60710
Frequently asked questions
Does CVE-2025-60710 affect my FedRAMP authorization?
If Microsoft Windows runs inside your authorization boundary, CVE-2025-60710 is a direct concern for your Federal Risk and Authorization Management Program (FedRAMP) authorization. CISA's Known Exploited Vulnerabilities (KEV) catalog lists this vulnerability, and its remediation deadline of April 27, 2026 has already passed. An unpatched KEV inside your boundary is a finding your assessor and sponsoring agency can see now. At this stage, you either close it out or formally document the mitigation and the delay.
How does Knox help me handle CVE-2025-60710?
Knox does not patch Microsoft Windows on your behalf. Under the FedRAMP shared-responsibility model, that remediation belongs to you. What Knox provides is the pre-authorized, single-tenant boundary to carry out that work in, along with Knox's automated continuous monitoring platform and audit-artifact coverage that document the fix for your next assessment. The work of applying the patch is yours; maintaining a defensible compliance posture while you do it is not something you have to manage alone.
How does Knox's monitoring help with vulnerabilities like this?
Knox's automated continuous monitoring platform watches your environment continuously for newly disclosed vulnerabilities and compliance issues, including ones like CVE-2025-60710. Exposure surfaces during ongoing monitoring rather than waiting until an assessor flags it at a scheduled review, which gives you time to act before a finding becomes a formal conversation with your agency.
How do I get FedRAMP authorized with Knox?
Knox runs a FedRAMP-as-a-Service platform. It gives SaaS vendors a pre-authorized cloud boundary on AWS, Azure, and GCP. Your application inherits 60-80% of the required security controls. You reach FedRAMP authorization in about 90 days for roughly 90% less than the traditional $3.5M path. Book a meeting and Knox will map your path to authorization.
CVE-2025-60710's remediation deadline of April 27, 2026 has passed. What happens now?
If CVE-2025-60710 remains unremediated, it is already a Plan of Action and Milestones (POA&M) item. A growing POA&M list is what turns a routine continuous-monitoring review into a difficult conversation with your sponsoring agency. Closing the vulnerability out now and documenting why the deadline was missed is what keeps your authorization intact and the agency relationship on solid footing.
Access continuous compliance
We never compromise on security. Meet with our team to discuss scope, readiness, and map your company’s accelerated path to government certification.
_Horizontal_RGB.png)
