Windows Task Host link-following privilege escalation (CVE-2025-60710)
Vulnerability
Summary
Hide ▲
Show ▼
CISA added CVE-2025-60710 to its actively exploited catalog after finding a Windows Task Host link-following flaw that can let local attackers escalate to SYSTEM on Windows 11 and Windows Server 2025. Microsoft had already patched the issue in November 2025, and CISA told FCEB agencies to secure systems within two weeks under BOD 22-01. The weakness matters because a low-complexity local exploit can hand an attacker full control of the compromised device.
Related Happenings
Microsoft Edge stops loading saved passwords into cleartext memory at startup
Security Tool/Service
First: 15.05.2026 17:49
Last: 15.05.2026 17:49
Sources 1
About this happening:
**Microsoft Edge** is changing its built-in password manager so **saved passwords** are no longer loaded into **process memory in clear text** at startup, reducing the risk of loc...
Microsoft Edge stops loading saved passwords into cleartext memory at startup
Security Tool/ServiceAbout this happening: **Microsoft Edge** is changing its built-in password manager so **saved passwords** are no longer loaded into **process memory in clear text** at startup, reducing the risk of loc...
Pwn2Own Berlin 2026 multi-product zero-days privilege-escalation flaw
Vulnerability
First: 14.05.2026 21:53
Last: 14.05.2026 21:53
Sources 1
About this happening:
**Pwn2Own Berlin 2026** opened with **24 unique zero-days** demonstrated against **fully patched products**, creating immediate exposure across browser, OS, virtualization, enterp...
Pwn2Own Berlin 2026 multi-product zero-days privilege-escalation flaw
VulnerabilityAbout this happening: **Pwn2Own Berlin 2026** opened with **24 unique zero-days** demonstrated against **fully patched products**, creating immediate exposure across browser, OS, virtualization, enterp...
Windows 11 BitLocker bypass YellowKey security flaw
Vulnerability
First: 14.05.2026 10:27
Last: 14.05.2026 10:27
Sources 1
About this happening:
**YellowKey** is a **Windows BitLocker security feature bypass** tracked as **CVE-2026-45585** that can expose **BitLocker-protected drives** through the **Windows Recovery Enviro...
Windows 11 BitLocker bypass YellowKey security flaw
VulnerabilityAbout this happening: **YellowKey** is a **Windows BitLocker security feature bypass** tracked as **CVE-2026-45585** that can expose **BitLocker-protected drives** through the **Windows Recovery Enviro...
Latest development: 20.05.2026 10:31
Microsoft assigned CVE-2026-45585 to YellowKey, a Windows BitLocker security feature bypass, and recommended removing autofstx.exe from the Session Manager BootExecute REG_MULTI_SZ value, reestablishing BitLocker trust for WinRE, and moving already encrypted devices from TPM-only to TPM+PIN to require a pre-boot PIN.
Microsoft MDASH enters limited private preview for AI-driven vulnerability discovery at scale
Security Tool/Service
First: 13.05.2026 16:46
Last: 13.05.2026 16:46
Sources 1
About this happening:
Microsoft's **MDASH** has entered **limited private preview**, adding a new **AI-driven vulnerability discovery** service that can validate and prove exploitable defects at scale....
Microsoft MDASH enters limited private preview for AI-driven vulnerability discovery at scale
Security Tool/ServiceAbout this happening: Microsoft's **MDASH** has entered **limited private preview**, adding a new **AI-driven vulnerability discovery** service that can validate and prove exploitable defects at scale....
CISA adds ScreenConnect and Windows flaws to KEV
Public Sector Action
First: 29.04.2026 11:46
Last: 29.04.2026 11:46
Sources 1
About this happening:
CISA added **CVE-2024-1708** and **CVE-2026-32202** to the **KEV catalog**, elevating the flaws to a **federal remediation priority** because they are being **actively exploited**...
CISA adds ScreenConnect and Windows flaws to KEV
Public Sector ActionAbout this happening: CISA added **CVE-2024-1708** and **CVE-2026-32202** to the **KEV catalog**, elevating the flaws to a **federal remediation priority** because they are being **actively exploited**...
Timeline
-
15.04.2026 17:51 2 articles · 1mo ago
CISA warns on CVE-2025-60710 in Windows Task Host
Initial DisclosureCISA warned U.S. Federal Civilian Executive Branch agencies and other defenders about CVE-2025-60710 in Windows Task Host, a link-following privilege escalation affecting Windows 11 and Windows Server 2025. The flaw can let local attackers with basic user permissions gain SYSTEM privileges and full control of a compromised device, and CISA said FCEB agencies must secure their systems within two weeks under BOD 22-01 while Microsoft had already patched the issue in November 2025.
Show sources
- CISA flags Windows Task Host vulnerability as exploited in attacks — www.bleepingcomputer.com — 15.04.2026 17:51
- CISA flags Windows Task Host vulnerability as exploited in attacks — www.bleepingcomputer.com — 15.04.2026 17:51