As reported by BleepingComputer, CISA has updated its Known Exploited Vulnerabilities (KEV) catalog to flag CVE-2025-60710 as actively exploited by ransomware gangs — a significant escalation from its April addition for general in-the-wild exploitation.
This development matters because it transforms a privilege escalation vulnerability into a confirmed ransomware enabler. The attack chain is straightforward: initial access via phishing, credential theft, or another vector grants a basic user account, then CVE-2025-60710 exploitation bridges the gap to SYSTEM-level control. That elevation is often the difference between a contained incident and a domain-wide encryption event.
Vulnerability Profile
| Field | Detail |
|---|---|
| CVE ID | CVE-2025-60710 |
| Severity | High |
| Type | Link following / Privilege Escalation |
| Affected Products | Windows 11, Windows Server 2025 |
| Vendor | Microsoft |
| Patch Available | Yes — November 2025 Patch Tuesday |
| Active Exploitation | Confirmed — general exploitation since April 2026; ransomware involvement confirmed August 2026 |
| Exploitation Prerequisite | Local attacker with basic user privileges |
| Impact | SYSTEM-level code execution |
Why Ransomware Groups Want Privilege Escalation
Ransomware operators rarely deploy encryptors directly from initial access footholds. They enumerate, escalate, and move laterally — and privilege escalation vulnerabilities like this one are the linchpin. With SYSTEM access, attackers can disable EDR agents, clear event logs, dump LSASS for domain credentials, and deploy ransomware via group policy or PsExec at scale.
The pattern is consistent: CISA has flagged 383 actively exploited Microsoft vulnerabilities since November 2021, with 112 tied to ransomware operations. Privilege escalation flaws are disproportionately represented in that subset.
Who Is Most at Risk
- Windows 11 and Server 2025 environments that have not applied the November 2025 patch
- Organizations with shared workstation accounts or environments where standard users have broad local privileges
- Healthcare, education, and SMB sectors with historically slower patch cadences and frequent ransomware targeting
- Multi-tenant or terminal server deployments where multiple users share a single host — exploitation by one tenant compromises the entire machine
Shield53 Recommendations
Immediate Actions:
- Patch now: Apply the November 2025 cumulative update (KB5046617 or later) to all Windows 11 and Server 2025 hosts. Verify via
wmic qfe list briefor your patch management dashboard. - Hunt for exploitation artifacts: Monitor for unexpected SYSTEM-privileged child processes spawned from
taskhostw.exe. Create detection rules for taskhostw.exe spawning cmd.exe, powershell.exe, or certutil.exe under SYSTEM context. - Review local group memberships: Audit which accounts hold local administrator rights and remove unnecessary elevated access to shrink the attack surface for post-exploitation.
- Enforce application allowlisting: Deploy Windows Defender Application Control (WDAC) or AppLocker to prevent unauthorized executables from running with elevated privileges.
- Validate EDR coverage: Confirm your endpoint protection supports tamper protection and cannot be disabled by SYSTEM-level processes without additional authentication.
Strategic Actions:
- Implement least-privilege access models — remove local admin rights from standard users wherever possible.
- Adopt a formal patch SLA for KEV-listed vulnerabilities: 14 days for federal alignment, 7 days recommended for high-risk sectors.
The nine-month gap between patch availability and ransomware exploitation confirmation suggests many organizations remain unpatched. If you haven't applied November 2025 updates to your Windows 11 or Server 2025 fleet, treat this as an emergency — not a routine maintenance task.
