CVE-2025-60710: Windows Task Host (taskhostw.exe) Link Following Privilege Escalation to SYSTEM via Recall PolicyConfiguration Scheduled Task — Threadlinqs Intelligence
As of 2026-05-30, CVE-2025-60710: Windows Task Host (taskhostw.exe) Link Following Privilege Escalation to SYSTEM via Recall PolicyConfiguration Scheduled Task is a high-severity vulnerability threat attributed to a N/A-nexus actor, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 14 indicators of compromise.
Threat ID: TL-2026-0370 · Severity: HIGH · CVSS: 7.8 · Status: ACTIVE · Category: VULNERABILITY
Attribution: N/A · UNKNOWN
A link following vulnerability (CWE-59) in the Host Process for Windows Tasks (taskhostw.exe) allows a local authenticated attacker to escalate privileges to NT AUTHORITY\SYSTEM by exploiting the
CVE-2025-60710 is a local privilege escalation vulnerability in the Host Process for Windows Tasks (taskhostw.exe / taskhostex.exe) caused by improper link resolution before file access (CWE-59). The vulnerability exists in the \Microsoft\Windows\WindowsAI\Recall\PolicyConfiguration scheduled task, which runs as NT AUTHORITY\SYSTEM.
When the PolicyConfiguration scheduled task executes, taskhostw.exe opens the user-controlled directory C:\Users\%username%\AppData\Local\CoreAIPlatform.00\UKP and searches for subdirectories matching the GUID pattern {????????-????-????-????-????????????}. If matching directories are found, they are deleted without validating whether they are symbolic links or junction points. Since low-privilege users have full control over their own %LOCALAPPDATA% folder, an attacker can create a junction point or symbolic link in the UKP directory that redirects the SYSTEM-privileged delete operation to an arbitrary target directory.
The scheduled task can be triggered through multiple mechanisms including the WnfStateChangeTrigger (specifically RecallPolicyCheckUpdateTrigger), AADStatusChangeTrigger, DisableAIDataAnalysisTrigger, UserLoginTrigger, and SessionUnlockTrigger. The RecallPolicyCheckUpdateTrigger via Windows Notification Facility (WNF) state changes provides the most reliable trigger mechanism for exploitation.
The attack chain proceeds as follows: (1) The attacker obtains a local foothold on the target system with standard user privileges. (2) The attacker creates the CoreAIPlatform.00\UKP directory structure in their %LOCALAPPDATA% if it does not already exist. (3) The attacker creates a GUID-named junction point within the UKP directory pointing to a sensitive system directory (e.g., C:\Windows\System32\config or a protected service directory). (4) The attacker triggers the PolicyConfiguration scheduled task via WNF state change or waits for a natural trigger event such as user login or session unlock. (5) taskhostw.exe, running as SYSTEM, resolves the junction and deletes the target directory, enabling further exploitation such as DLL planting, service configuration manipulation, or security control bypass.
The arbitrary folder deletion primitive can be escalated to full SYSTEM code execution through well-known techniques such as replacing deleted system binaries, manipulating Windows Installer rollback directories, or exploiting service recovery mechanisms that reference the deleted paths.
The vulnerability affects Windows 11 24H2 (builds prior to 10.0.26100.7462), Windows 11 25H2 (builds prior to 10.0.26200.7462), and Windows Server 2025 (builds prior to 10.0.26100.7462) including Server Core installations. Microsoft patched the vulnerability in the November 2025 Patch Tuesday release, with additional patches in December 2025 (KB5072033, KB5072014 hotpatch). Despite being patched for five months, CISA confirmed active exploitation in April 2026, indicating significant patching gaps in enterprise environments.
The EPSS score of 0.18238 (95th percentile) reflects high exploitation probability. Four public proof-of-concept exploits are available on GitHub, with the most notable being the redpack-kr/CVE-2025-60710 repository containing C/C++ exploit code. The combination of low attack complexity, no user interaction requirement, public PoC availability, and confirmed active exploitation makes this a critical priority for patching.
Target sectors: government, financial, healthcare, technology, defense, critical-infrastructure, education, energy
Target regions: North America, Europe, Asia-Pacific, Global
Detections & IOCs
As of 2026-07-28, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 14 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
VULNERABILITY, HIGH, threat intelligence, cybersecurity, CVE-2025-60710, T1068, T1053, T1053, T1053, T1211, T1070, T1574, T1574, T1485, T1083