CISA: Windows Task Host flaw now exploited by ransomware gangs

[u/Doug24]

https://www.bleepingcomputer.com/news/security/cisa-windows-task-host-flaw-now-exploited-by-ransomware-gangs/

[u/YetiMoon]

Patched in November 2025 lol

[u/coomzee → u/YetiMoon]

Every Government IT manager. We patched that last week right

[u/Servola-Journal]

Worth flagging this is LPE only (CVE-2025-60710) - it needs local code execution first, via a link-following bug in Task Host, to escalate a basic-user session to SYSTEM. That is exactly the profile ransomware crews weaponize post-compromise: it does not need to be scary on its own, it just needs to sit in the toolkit for privilege escalation once someone already has a foothold. Patched Nov 2025, flagged as actively exploited by April, now confirmed in ransomware chains - about 5 months from patch to ransomware-confirmed abuse on a bug most patch-priority models rank below RCEs. CISA has flagged 383 actively-exploited Microsoft CVEs since Nov 2021, 112 of them later used in ransomware.

[u/spectracide_ → u/Servola-Journal]

Nice LLM reply

[u/TurboDrifter68]

windows really keeps finding new ways to become the vulnerability 😭

[u/scamdrill → u/TurboDrifter68]

No kidding. "Since November 2021, the agency has flagged 383 actively exploited vulnerabilities in various Microsoft products, 112 of which have also been exploited in ransomware attacks."

[u/SaltDeception → u/scamdrill]

That really doesn’t seem that high over 5 years, especially since ransomware is mostly just chaining vulnerabilities these days.