CVE-2025-60710

This flaw is like a trusted “task runner” in Windows that checks a file path, but can be tricked into opening the wrong (malicious) file. If an attacker already has a low level of access on your PC or server and can tamper with files in a watched folder/path, they can push the task runner to execute code with higher privileges. That makes it much easier for ransomware crews to take over machines and do more damage.

This matters if your business uses Windows 11 PCs or Windows Server 2025 servers. The attack is local and requires an attacker to already have low-privileged credentials on the target machine, plus the ability to place or modify files in a location watched by the Host Process for Windows Tasks service. In other words, it’s a serious risk mainly when a foothold exists and the attacker can reach those watched file locations (the vulnerability is reachable in default configuration).

This is RED because confirmed ransomware gangs are exploiting CVE-2025-60710 in real attacks. That means you should assume active compromise attempts are already underway, and patching is the immediate priority for affected machines. CISA’s KEV entry also gives a clear remediation deadline of 2026-04-27.