Full research report
CISA: Windows Task Host flaw now exploited by ransomware gangs
Executive assessment
CISA's August 2026 ransomware designation for CVE-2025-60710 completes a textbook exploitation arc: patched in November 2025, actively exploited within five months, and now confirmed in ransomware playbooks nine months after the fix became available — underscoring the persistent failure to patch locally-exploitable privilege escalation flaws at scale. The vulnerability's value to ransomware operators is its role as a reliable post-initial-access escalation step: any foothold gained through phishing, credential theft, or another vector is convertible to SYSTEM without requiring additional privileges, enabling credential harvesting and lateral movement at speed. CVE-2026-45659 presents a structurally different and higher-urgency risk: a network-accessible deserialization RCE requiring only Site Member authentication against on-premises SharePoint means it functions as an initial-access vector, not merely a post-exploitation tool, explaining its faster progression from KEV listing to ransomware confirmation (roughly six weeks). The Storm-2603 attribution suggests deliberate targeting of organisations running legacy on-premises SharePoint, which lacks the automatic security updates of cloud-hosted SharePoint Online, creating a persistent exposure window for organisations that have not completed cloud migration or applied the May 2026 patch. Defenders should treat unpatched on-premises SharePoint installations as critically exposed given the low authentication bar and the three-month window since patches became available.
What happened
On 18 August 2026, CISA updated its Known Exploited Vulnerabilities Catalogue to confirm that ransomware gangs are actively exploiting CVE-2025-60710, a privilege-escalation flaw in the Windows Host Process for Windows Tasks (taskhostw.exe) that Microsoft patched in November 2025. The KEV entry had first been created on 13 April 2026 indicating active exploitation, but the ransomware designation was added approximately four months later. One week earlier, CISA similarly confirmed ransomware exploitation of CVE-2026-45659, a deserialization remote code execution flaw in on-premises Microsoft SharePoint Server patched in May 2026 and added to the KEV catalogue on 1 July 2026.
Affected scope
CVE-2025-60710 affects Windows 11 versions 24H2 and 25H2 (ARM64 and x64) and Windows Server 2025 including Server Core installations; unpatched versions run build numbers below 10.0.26100.7462. CVE-2026-45659 affects Microsoft SharePoint Enterprise Server 2016 (before 16.0.5552.1002), SharePoint Server 2019 (before 16.0.10417.20128), and SharePoint Server Subscription Edition (before 16.0.19725.20280). Federal Civilian Executive Branch agencies faced mandatory remediation deadlines under BOD 22-01.
Technical assessment
CVE-2025-60710 (CVSS 7.8, CWE-59) is an improper symbolic-link resolution weakness in the Windows Task Host process. A locally authenticated user with standard privileges can redirect file operations performed by a high-privilege scheduled task into an attacker-controlled path, converting standard user access to SYSTEM-level control without any administrative rights. Research from Jacob Krell points to a Windows AI Recall scheduled task that operates on a user-writable AppData directory without validating junctions or symlinks as the specific vulnerable context. CVE-2026-45659 (CVSS 8.8, CWE-502) involves deserialization of untrusted data within SharePoint Server: any network-accessible authenticated user holding Site Member permissions can submit a crafted payload that executes code under the SharePoint application identity, providing a network-based initial-access vector requiring no elevated privileges.
Recommended defensive actions
- Apply Microsoft's November 2025 cumulative update (Windows build ≥10.0.26100.7462) across all Windows 11 24H2, 25H2, and Server 2025 endpoints to remediate CVE-2025-60710.
- Apply Microsoft's May 2026 out-of-band SharePoint Server security update to each affected installation — Subscription Edition (≥16.0.19725.20280), Server 2019 (≥16.0.10417.20128), Enterprise Server 2016 (≥16.0.5552.1002) — to remediate CVE-2026-45659.
- Verify patch deployment via endpoint management tooling; prioritise internet-facing SharePoint servers and domain controllers where SYSTEM-level privilege escalation would have the highest impact.
- Hunt for post-exploitation indicators on unpatched systems: unexpected SYSTEM-level process lineage from taskhostw.exe, junction or symlink creation events in user AppData paths, and web-shell artefacts or anomalous process spawning from SharePoint worker processes (w3wp.exe).
- Restrict SharePoint Site Member permissions to the minimum required population and monitor for anomalous authenticated sessions, unexpected outbound connections, or lateral movement activity originating from SharePoint server hosts.
Uncertainties and evidence gaps
- CISA has not disclosed specific ransomware group names, victim organisations, or attack-chain details for CVE-2025-60710 exploitation; actor attribution remains unknown.
- No public proof-of-concept code for CVE-2025-60710 was identified during research; the vulnerable path has been described conceptually by one researcher but has not been independently verified through a published PoC.
- Attribution of CVE-2026-45659 exploitation to Storm-2603 and Warlock ransomware appears in a single reporting outlet and has not been corroborated by a government advisory or Microsoft statement.
- Whether CVE-2025-60710 and CVE-2026-45659 are being chained together in live campaigns or exploited independently is not established by any verified source.
Vulnerability flow
Defender-oriented path reconstructed only from sourced report findings. Unknown stages are omitted.
Both CVEs are confirmed actively exploited by ransomware gangs per CISA KEV: CVE-2025-60710 received a ransomware designation update in August 2026 (first added April 13 2026); CVE-2026-45659 received its ransomware designation in August 2026 (first added July 1 2026), with Storm-2603 linked to Warlock ransomware deployments against SharePoint.
The investigation began with two CVEs stated in CISA KEV records with ransomware designations. Primary source fetching via NVD confirmed both vulnerabilities exist with the stated technical characteristics, affected scopes, and KEV dates. Multiple independent news outlets corroborated the CISA KEV ransomware updates and supplied additional context including the Storm-2603 and Warlock ransomware attribution for CVE-2026-45659 and researcher-attributed technical detail for CVE-2025-60710. No public proof-of-concept was identified for CVE-2025-60710, and no government source confirmed actor attribution for its ransomware exploitation, leaving those as material uncertainties.
- What is CVE-2025-60710 and what exploitation has been confirmed?Searched for CVE-2025-60710 Windows Task Host CISA KEV ransomware 2026
Confirmed link-following privilege escalation in Windows Task Host patched November 2025; CISA KEV added April 13 2026; ransomware flag updated August 2026 per multiple outlets.
why Established baseline facts and identified primary sources to verify.
- What is CVE-2026-45659 and what exploitation and actor attribution has been reported?Searched for CVE-2026-45659 Microsoft SharePoint RCE ransomware CISA 2026
SharePoint deserialization RCE patched May 2026; CISA KEV July 1 2026; Storm-2603 attributed to Warlock ransomware deployments targeting on-premises SharePoint.
why Identified the secondary CVE's scope, severity, and reported attribution for subsequent verification.
- Does the primary reporting article accurately represent the CISA KEV update for CVE-2025-60710?Fetched BleepingComputer article on Windows Task Host ransomware storybleepingcomputer.com ↗
Article confirmed CISA updated the KEV ransomware flag for CVE-2025-60710 on August 18 2026 and noted the CVE-2026-45659 ransomware update one week earlier; no specific actor or victim disclosed.
why Verified the source article is genuine and internally consistent; absence of specific actor attribution means that field requires a separate evidence basis.
- What are the precise technical attributes and patch details for CVE-2025-60710?Fetched NVD vulnerability record for CVE-2025-60710nvd.nist.gov ↗
CVSS 7.8 HIGH, CWE-59, affects Windows 11 24H2/25H2 and Server 2025 (builds below 10.0.26100.7462), published November 11 2025, CISA KEV added April 13 2026.
why NVD is a primary authoritative record; patch build numbers are essential for accurate defensive guidance.
- Does independent reporting corroborate the CVE-2025-60710 ransomware flag and supply additional technical context?Fetched SC World article on CISA ransomware confirmation for CVE-2025-60710scworld.com ↗
Confirmed KEV ransomware update (approximately August 14 2026); researcher Jacob Krell described the vulnerable path as a Windows AI Recall scheduled task operating on a user-writable AppData directory without junction-checking.
why Independent domain corroborating the KEV update; named researcher detail adds technical specificity and is sourced, not inferred.
- What are the precise technical attributes and patch targets for CVE-2026-45659?Fetched NVD vulnerability record for CVE-2026-45659nvd.nist.gov ↗
CVSS 8.8 HIGH, CWE-502, published May 22 2026, affects SharePoint Enterprise 2016 (before 16.0.5552.1002), Server 2019 (before 16.0.10417.20128), Subscription Edition (before 16.0.19725.20280); CISA KEV added July 1 2026.
why Confirmed affected versions and precise patch build numbers required for accurate remediation guidance.
- Does the Storm-2603 and Warlock ransomware attribution for CVE-2026-45659 have independent evidential support?Fetched The Hacker News reporting on CVE-2026-45659 CISA KEV additionthehackernews.com ↗
Confirmed Storm-2603 deploying Warlock ransomware targeting on-premises SharePoint since mid-2025; exploitation requires only Site Member permissions over the network.
why Attribution appears in a second outlet (THN), but no government advisory has independently confirmed it; assessed as credible claim rather than established fact.
- Is there a public proof-of-concept for CVE-2025-60710 that materially raises exploitation risk?Searched for CVE-2025-60710 proof of concept exploit code GitHub 2026
No specific PoC for CVE-2025-60710 was returned; general CVE PoC aggregator repositories were found but none contained a confirmed working public exploit for this CVE.
why Absence of a confirmed public PoC is a material defensive finding; it slightly reduces the immediacy of risk relative to CVEs with published exploit code, though KEV designation confirms real-world use.
Research coverage
All 68 registered source leaves were evaluated for this run: 61 completed, 0 were unavailable, 0 failed and 7 were disabled. For this story, 5 registered sources supplied useful evidence (3 primary, 1 corroborating, 1 contextual and 0 PoC/exploit references). 56 completed sources contained no matched information for this story.
Complete source-by-source audit 68 sources
| Source | Run result | Value | Why it was useful — or not |
|---|---|---|---|
| BleepingComputernews | ok7 records | Primary evidence2 matched items | Published the source report used to frame and date the event. Supplied independent analysis opened and verified during focused research. |
| CISA KEVkev | ok1670 records | Primary evidence2 matched items | Confirmed that a related CVE is listed in CISA's Known Exploited Vulnerabilities catalogue. |
| NVDcve | ok900 records | Primary evidence2 matched items | Supplied a vendor or government advisory opened and verified during focused research. |
| CISA Alertsnews | ok empty0 records | Corroborating1 matched items | A page from this source was opened and verified during focused research. |
| FIRST EPSSepss | ok7785 records | Context2 matched items | Added exploitation-probability context; EPSS does not itself prove exploitation. |
| AlienVault OTXdark_web | ok10 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| CIRCL CVEcve | ok30 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Cisco PSIRTvendor_advisory | ok5324 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Cisco Talosnews | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| deepdarkCTI CVE most exploiteddeepdarkcti | ok94 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI Discorddeepdarkcti | ok7 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI exploitsdeepdarkcti | ok24 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI forumsdeepdarkcti | ok264 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI malware as a servicedeepdarkcti | ok7 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI malware samplesdeepdarkcti | ok3 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI marketsdeepdarkcti | ok127 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI phishingdeepdarkcti | ok19 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI ransomware gangsdeepdarkcti | ok685 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI RATsdeepdarkcti | ok1 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI Telegram infostealerdeepdarkcti | ok130 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI Telegram threat actorsdeepdarkcti | ok1009 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI Twitter threat actorsdeepdarkcti | ok39 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| DNSDumpster domain IOC enrichmentresearch | ok1 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Exploit-DBexploit_reference | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Fortinet PSIRTvendor_advisory | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| GitHub topic: cveresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| GitHub topic: exploitresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| GitHub topic: penetration-testingresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| GitHub topic: pocresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| GitHub topic: vulnerabilityresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| GreyNoiseexploit_reference | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| KrebsOnSecuritynews | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| LinkedIn RSS proxy feeds (disabled)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| MalwareBazaardark_web | ok2 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #cveresearch | ok20 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #cybersecurityresearch | ok16 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #exploitresearch | ok15 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #infosecresearch | ok20 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #malwareresearch | ok20 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #ransomwareresearch | ok19 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #threatintelresearch | ok15 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #vulnerabilityresearch | ok20 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Metasploit module metadataexploit_reference | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Microsoft MSRCvendor_advisory | ok1590 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Microsoft Securitynews | ok1 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| MISP Galaxyresearch | ok1 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| MISP threat actor galaxyactor | ok0 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Palo Alto Networks PSIRTvendor_advisory | ok25 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| ProjectDiscovery nuclei templatesexploit_reference | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Rapid7news | ok1 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Reddit r/AskNetsec (pending API approval)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| Reddit r/cybersecurity (pending API approval)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| Reddit r/malware (pending API approval)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| Reddit r/netsec (pending API approval)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| Reddit r/ReverseEngineering (pending API approval)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| SANS ISCnews | ok1 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Shadowserver public aggregate honeypot observationsexploit_reference | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Shodanresearch | ok3 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Sigma Rulesresearch | ok3 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Sophos IOCsresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| The Hacker Newsnews | ok9 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| ThreatFoxthreat_intelligence | ok100 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| UK NCSCnews | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Unit42 IOCsresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| URLhausdark_web | ok10 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| VirusTotal Community IOC enrichmentresearch | ok4 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| VulnCheck KEVkev | ok500 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Vulnerability Lookupcve | ok30 records | Checked — no match | The source completed, but none of its retained records matched this story. |
Additional verified pages 5 opened outside the registered collection
Vulnerability & exploitation4
Vendor & gov advisories2
Authoritative record: CVSS 7.8 HIGH, CWE-59, patch build ≥10.0.26100.7462, CISA KEV April 13 2026
Authoritative record: CVSS 8.8 HIGH, CWE-502, published May 22 2026, CISA KEV July 1 2026
Analysis & research4
Confirmed CISA KEV ransomware flag for CVE-2025-60710 updated August 18 2026; contextualises alongside CVE-2026-45659
Independent corroboration; attributes technical mechanism to researcher Jacob Krell and the Windows AI Recall scheduled task path
Attributes CVE-2026-45659 exploitation to Storm-2603 deploying Warlock ransomware; confirms Site Member permission requirement
Independent corroboration of CVE-2026-45659 KEV addition and exploitation confirmation