On November 11, 2025, Microsoft disclosed a serious security hole in Windows that could let a low-privileged user completely take over a machine. The flaw, tracked as CVE-2025-60710, sits in the Host Process for Windows Tasks—a core component that runs background services—and stemmed from a classic link-following mistake. The good news: a fix is already available through Windows Update. The bad news: every supported version of Windows is affected, and the attack is straightforward for someone who already has a foothold on your computer.

The Vulnerability in Plain English

The vulnerability is what security researchers call an “improper link resolution” or “TOCTOU” (time-of-check-time-of-use) bug. In plain English, when the task host process goes to access a file, it doesn’t properly verify that the file is exactly what it expects. An attacker who can create a symbolic link—a kind of shortcut that redirects file operations—can trick the process into reading, writing, or deleting a different file than intended. Since the task host often runs with high privileges (SYSTEM), compromising it can give an attacker full control.

Concretely, this means an attacker who has already gained a limited foothold on your PC—say, through a malicious email attachment or a drive-by download—can exploit this flaw to elevate their privileges. They could rewrite system files, install persistent malware, or disable security software, all without needing to figure out your administrator password. Microsoft has assigned this vulnerability a CVSS score of 7.8, categorizing it as “Important,” but the low attack complexity and local access requirement make it a tempting target for real-world attackers once exploit code emerges.

Who Needs to Worry?

For home users, the risk is most acute if you regularly download files from untrusted sources or open attachments from unknown senders. A malicious installer or document could initially run with limited user rights, then use this vulnerability to gain SYSTEM access, effectively owning your device. This is the digital equivalent of a burglar picking the lock on your front door, then finding the keys to every room and the safe.

For businesses, the stakes are higher. Any environment where multiple users share a single machine—terminal servers, virtual desktops, or shared workstations—is a prime target. A standard user on a company network who runs a malicious script could compromise the entire server. Administrative workstations and jump servers, often used to manage critical infrastructure, are especially valuable targets because a single successful exploit can provide a beachhead for lateral movement across the network.

Windows Server 2025 with Desktop Experience gets a special callout: Microsoft’s advisory specifically mentions that customers running this configuration are affected. If you manage such servers, you’ll want to pay attention to the workaround detailed below.

Patch Now: How to Get the Fix

The most effective step is to install the security updates Microsoft released alongside the advisory. These updates alter the Host Process for Windows Tasks to properly validate file paths before operating on them, closing the link-following loophole.

For Individual Users and Small Businesses

Open Windows Update (Settings → Windows Update) and check for updates. The relevant patch will be listed as one of the November 2025 security updates for your Windows version. If you don’t see it, use the “Download and install” option to force a check. Restart your PC once the update is applied.

For IT Administrators

You’ll need to map CVE-2025-60710 to the exact KB article for each Windows build in your environment. Microsoft’s Security Update Guide is the authoritative source—visit the entry for this CVE to find the KB number matching your OS editions. Deploy through your usual patch management system (WSUS, Microsoft Endpoint Manager, or a third-party tool) and verify installation with your endpoint configuration manager. Don’t assume success; actively scan for the KB and confirm that devices have rebooted.

Microsoft recommends an accelerated rollout for high-value targets: administrative workstations, jump servers, multi-user servers, and any device where non-administrative accounts routinely run code. For typical enterprise environments, a phased deployment—pilot group for 24–72 hours, then production—balances safety with speed.

Temporary Mitigation for Windows Server 2025 Desktop Experience

If you’re running Windows Server 2025 with Desktop Experience and cannot patch immediately, Microsoft suggests a workaround: disable a specific scheduled task. This isn’t a permanent fix, but it blocks the known attack path until you can apply the update.

How to Apply the Workaround

  1. Open Task Scheduler (search for it in the Start menu).
  2. Navigate to \Microsoft\Windows\WindowsAI\Recall.
  3. Right-click PolicyConfiguration and select Disable.
  4. Leave it disabled until after you’ve installed the security update.

Important: Once the patch is in place, re-enable the task. Disabling it indefinitely may affect related functionality (the task is tied to Windows AI Recall, though Microsoft hasn’t detailed potential side effects). As with any workaround, test in a non-production environment first if possible.

How Did This Happen? A Quick Look Under the Hood

Link-following vulnerabilities have plagued operating systems for decades. They occur when a privileged process checks a file path, finds it acceptable, and then later opens or writes to that path—but in the tiny window between check and use, an attacker replaces the file with a symbolic link pointing somewhere else. The process follows the link unaware, effectively acting on the attacker’s behalf with its elevated rights.

In Windows, this exploit class often involves NTFS reparse points—a feature that enables symlinks, junctions, and mount points. A standard user can create these special files, and many system services interact with them without adequate safeguards. The Host Process for Windows Tasks (taskhostw.exe or taskhostex.exe) is a generic container for DLL-based services and task components; it runs in various sessions, sometimes with SYSTEM privileges, making it an attractive target for such attacks.

This is not the first privilege escalation bug of its kind, and it won’t be the last. What makes CVE-2025-60710 noteworthy is the combination of a ubiquitous target (the task host runs on every Windows installation) and the low barrier to exploitation. Unlike memory corruption bugs that require precise control, TOCTOU flaws only need a script that creates a symlink, waits for the right moment, and swaps the target. PoC development is often rapid once the vulnerability is publicly detailed.

What to Watch For: Detection and Defense in Depth

Patching is your primary shield, but layered defenses reduce risk before and after you deploy the update. For security teams, monitoring for telltale signs of exploitation can alert you to active attacks.

Practical Detection Tips

  • Symbolic Link Creation: Monitor for mklink command use or calls to API functions like CreateSymbolicLink from non-administrative processes. Log events in paths used by system services, such as %SystemRoot%\System32 and %ProgramFiles%.
  • Unexpected File Operations: Alert when a low-privilege process writes to or replaces files in protected directories. Sudden modifications to service executables or DLLs should raise red flags.
  • Process Anomalies: Watch for the Host Process for Windows Tasks spawning unusual child processes or loading non-standard DLLs. A crash-and-restart cycle correlated with user action can indicate a failed or successful exploit attempt.
  • Privilege Escalation Artifacts: Look for token duplication calls (DuplicateTokenEx) or usage of CreateProcessAsUser from processes that normally don’t require such rights.

Baseline normal behavior for the task host process on your endpoints. Deviations should be investigated, even if no exploit is immediately evident.

Proactive Hardening

  • Least Privilege: Strip unnecessary local admin rights from standard users. Use just-in-time elevation for tasks that legitimately need it.
  • Application Control: Deploy Windows Defender Application Control (WDAC) or AppLocker to restrict what can run on critical systems. Even if an attacker gets in, app control can break the exploitation chain.
  • Directory Permissions: Review and tighten ACLs on system directories. Remove or restrict the ability for unprivileged users to create reparse points in sensitive areas.

What’s Next

As of this writing, there is no public proof-of-concept code for CVE-2025-60710, but that status won’t last. History shows that once Microsoft publishes a fix, reverse engineering quickly reveals the vulnerability details. Defenders should act as if weaponized exploits are imminent. Microsoft will likely include additional hardening in future patches, but the onus remains on users and administrators to apply the current fix without delay.

Keep an eye on the MSRC Update Guide for any revisions or expanded KB mappings. For now, the most important action is simple: patch your Windows devices. A few minutes of downtime for a reboot can prevent a full-blown system compromise.