CVE-2025-60710: Windows Task Host (taskhostw.exe) Link Following Privilege Escalation to SYSTEM via Recall PolicyConfiguration Scheduled Task

CVE-2025-60710 (TL-2026-0370), also tracked as Host Process for Windows Tasks Elevation of Privilege Vulnerability, is a high-severity software vulnerability scored CVSS 7.8, first published 2026-04-15. It has no confirmed attribution, affects Microsoft Windows 11 Version 24H2, references 1 CVE (CVE-2025-60710), maps to 8 MITRE ATT&CK techniques (T1053, T1068, T1070), and is covered by 9 detection rules and 14 indicators of compromise.

Key facts for TL-2026-0370

Threat ID
TL-2026-0370
Also known as
Host Process for Windows Tasks Elevation of Privilege Vulnerability
Severity
HIGH
CVSS
7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Status
ACTIVE
Category
VULNERABILITY
First published
2026-04-15
Last reviewed
2026-04-15
Attribution confidence
NONE
Motivation
UNKNOWN
Target sectors
government, financial, healthcare, technology, defense, critical-infrastructure, education, energy
Target regions
North America, Europe, Asia-Pacific, Global
Detection rules
9
Indicators of compromise
14

Malware and tooling in CVE-2025-60710

Malware and tooling: CVE-2025-60710 PoC (redpack-kr)

A link following vulnerability (CWE-59) in the Host Process for Windows Tasks (taskhostw.exe) allows a local authenticated attacker to escalate privileges to NT AUTHORITY\SYSTEM by exploiting the Windows AI Recall PolicyConfiguration scheduled task. CISA added this to KEV on 2026-04-13 confirming active exploitation in the wild, with a remediation deadline of 2026-04-27.

How CVE-2025-60710 works

CVE-2025-60710 is a local privilege escalation vulnerability in the Host Process for Windows Tasks (taskhostw.exe / taskhostex.exe) caused by improper link resolution before file access (CWE-59). The vulnerability exists in the \Microsoft\Windows\WindowsAI\Recall\PolicyConfiguration scheduled task, which runs as NT AUTHORITY\SYSTEM.

When the PolicyConfiguration scheduled task executes, taskhostw.exe opens the user-controlled directory C:\Users\%username%\AppData\Local\CoreAIPlatform.00\UKP and searches for subdirectories matching the GUID pattern {????????-????-????-????-????????????}. If matching directories are found, they are deleted without validating whether they are symbolic links or junction points. Since low-privilege users have full control over their own %LOCALAPPDATA% folder, an attacker can create a junction point or symbolic link in the UKP directory that redirects the SYSTEM-privileged delete operation to an arbitrary target directory.

The scheduled task can be triggered through multiple mechanisms including the WnfStateChangeTrigger (specifically RecallPolicyCheckUpdateTrigger), AADStatusChangeTrigger, DisableAIDataAnalysisTrigger, UserLoginTrigger, and SessionUnlockTrigger. The RecallPolicyCheckUpdateTrigger via Windows Notification Facility (WNF) state changes provides the most reliable trigger mechanism for exploitation.

The attack chain proceeds as follows: (1) The attacker obtains a local foothold on the target system with standard user privileges. (2) The attacker creates the CoreAIPlatform.00\UKP directory structure in their %LOCALAPPDATA% if it does not already exist. (3) The attacker creates a GUID-named junction point within the UKP directory pointing to a sensitive system directory (e.g., C:\Windows\System32\config or a protected service directory). (4) The attacker triggers the PolicyConfiguration scheduled task via WNF state change or waits for a natural trigger event such as user login or session unlock. (5) taskhostw.exe, running as SYSTEM, resolves the junction and deletes the target directory, enabling further exploitation such as DLL planting, service configuration manipulation, or security control bypass.

The arbitrary folder deletion primitive can be escalated to full SYSTEM code execution through well-known techniques such as replacing deleted system binaries, manipulating Windows Installer rollback directories, or exploiting service recovery mechanisms that reference the deleted paths.

The vulnerability affects Windows 11 24H2 (builds prior to 10.0.26100.7462), Windows 11 25H2 (builds prior to 10.0.26200.7462), and Windows Server 2025 (builds prior to 10.0.26100.7462) including Server Core installations. Microsoft patched the vulnerability in the November 2025 Patch Tuesday release, with additional patches in December 2025 (KB5072033, KB5072014 hotpatch). Despite being patched for five months, CISA confirmed active exploitation in April 2026, indicating significant patching gaps in enterprise environments.

The EPSS score of 0.18238 (95th percentile) reflects high exploitation probability. Four public proof-of-concept exploits are available on GitHub, with the most notable being the redpack-kr/CVE-2025-60710 repository containing C/C++ exploit code. The combination of low attack complexity, no user interaction requirement, public PoC availability, and confirmed active exploitation makes this a critical priority for patching.

MITRE ATT&CK techniques used in TL-2026-0370

Privilege Escalation

T1053 Scheduled Task/Job; T1068 Exploitation for Privilege Escalation

Defense Evasion

T1070 Indicator Removal; T1211 Exploitation for Stealth

Discovery

T1083 File and Directory Discovery

Impact

T1485 Data Destruction

Execution

T1569 System Services

stealth

T1574 Hijack Execution Flow

Affected products and versions in CVE-2025-60710

  • Microsoft — Windows 11 Version 24H2
    Vulnerable versions: 10.0.26100.0 to 10.0.26100.7461
    Fixed in: 10.0.26100.7462 (KB5072033)
  • Microsoft — Windows 11 Version 25H2
    Vulnerable versions: 10.0.26200.0 to 10.0.26200.7461
    Fixed in: 10.0.26200.7462 (KB5068861)
  • Microsoft — Windows Server 2025
    Vulnerable versions: 10.0.26100.0 to 10.0.26100.7461
    Fixed in: 10.0.26100.7462 (KB5072033)
  • Microsoft — Windows Server 2025 (Server Core)
    Vulnerable versions: 10.0.26100.0 to 10.0.26100.7461
    Fixed in: 10.0.26100.7462 (KB5072033)

Remediation for CVE-2025-60710

Patches

  • KB5072033 — Windows 11 24H2 / Server 2025 (build 10.0.26100.7462)
  • KB5072014 — Windows Server 2025 hotpatch (build 10.0.26100.7392)
  • KB5068861 — Windows 11 25H2 (build 10.0.26200.7462)

Immediate actions

  • Apply Microsoft security update KB5072033 to all affected Windows 11 24H2, 25H2, and Server 2025 systems
  • Apply hotpatch KB5072014 for Azure-hosted Windows Server 2025 instances
  • Monitor for suspicious junction/symlink creation in %LOCALAPPDATA%\CoreAIPlatform.00\UKP directories
  • Audit scheduled task execution logs for PolicyConfiguration task triggers
  • Enable Windows Defender Attack Surface Reduction (ASR) rules for symlink abuse detection

Workarounds

  • Disable the \Microsoft\Windows\WindowsAI\Recall\PolicyConfiguration scheduled task if Windows Recall is not in use
  • Remove or restrict write access to %LOCALAPPDATA%\CoreAIPlatform.00\UKP directory via GPO
  • Monitor and alert on reparse point creation in user profile directories using Sysmon or EDR

Longer-term hardening

  • Deploy EDR with behavioral detection for TOCTOU/symlink privilege escalation patterns
  • Implement application whitelisting to restrict junction point and symbolic link creation
  • Enable Sysmon with configuration to log symbolic link and junction point creation events (Event ID 11, 23)
  • Review and harden scheduled task permissions across the enterprise
  • Implement least-privilege access policies to minimize local authenticated attacker foothold risk

CVEs associated with CVE-2025-60710

CVE-2025-60710

Weaknesses (CWE) in CVE-2025-60710

CWE-59

Timeline of CVE-2025-60710

  • Proof-of-concept exploit code published on GitHub (redpack-kr/CVE-2025-60710) demonstrating arbitrary folder deletion via symlink abuse in CoreAIPlatform.00\UKP directory
  • NVD publishes CVE-2025-60710 with CVSS 7.8 HIGH rating and CWE-59 classification
  • Microsoft discloses CVE-2025-60710 as part of November 2025 Patch Tuesday, releasing initial security updates for Windows 11 24H2/25H2 and Windows Server 2025
  • Microsoft releases additional patches including KB5072033 (build 10.0.26100.7462) and hotpatch KB5072014 (build 10.0.26100.7392) providing further remediation
  • NVD entry for CVE-2025-60710 updated with additional affected product information and version details
  • CISA adds CVE-2025-60710 to Known Exploited Vulnerabilities (KEV) catalog based on evidence of active exploitation in the wild, setting remediation deadline of 2026-04-27 under BOD 22-01
  • NVD entry updated following CISA KEV addition with confirmed exploitation status and updated affected version ranges
  • BleepingComputer and security media report on CISA KEV addition, noting Microsoft has not yet confirmed active exploitation in their own advisory
  • CISA KEV remediation deadline for federal agencies under BOD 22-01 — FCEB agencies must have patches applied by this date
  • As of 2026-05-29, CVE-2025-60710 (taskhostw.exe Recall link-following LPE to SYSTEM) is patched by Microsoft (Nov-Dec 2025, KB5072033/KB5068861) yet remains actively exploited per CISA KEV (added 2026-04-13, deadline 2026-04-27). Multiple public PoCs (redpack-kr, Wh04m1001) and noted enterprise patching gaps keep it a live, high-priority threat.

Sources cited for CVE-2025-60710

Threats related to CVE-2025-60710

Detection coverage for TL-2026-0370

As of 2026-04-15, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0370 across Splunk SPL, Microsoft KQL and Sigma, covering 14 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats