# CVE-2025-60710: Windows Task Host (taskhostw.exe) Link Following Privilege Escalation to SYSTEM via Recall PolicyConfiguration Scheduled Task

> A link following vulnerability (CWE-59) in the Host Process for Windows Tasks (taskhostw.exe) allows a local authenticated attacker to escalate privileges to NT AUTHORITY\SYSTEM by exploiting the Windows AI Recall PolicyConfiguration scheduled task. CISA added this to KEV on 2026-04-13 confirming active exploitation in the wild, with a remediation deadline of 2026-04-27.

- **Published:** 2026-04-15T12:00:00Z
- **Last reviewed:** 2026-04-15T12:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0370
- **ID:** TL-2026-0370
- **Severity:** HIGH (CVSS 7.8)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 14 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2025-60710

## Description

CVE-2025-60710 is a local privilege escalation vulnerability in the Host Process for Windows Tasks (taskhostw.exe / taskhostex.exe) caused by improper link resolution before file access (CWE-59). The vulnerability exists in the \Microsoft\Windows\WindowsAI\Recall\PolicyConfiguration scheduled task, which runs as NT AUTHORITY\SYSTEM.

When the PolicyConfiguration scheduled task executes, taskhostw.exe opens the user-controlled directory C:\Users\%username%\AppData\Local\CoreAIPlatform.00\UKP and searches for subdirectories matching the GUID pattern {????????-????-????-????-????????????}. If matching directories are found, they are deleted without validating whether they are symbolic links or junction points. Since low-privilege users have full control over their own %LOCALAPPDATA% folder, an attacker can create a junction point or symbolic link in the UKP directory that redirects the SYSTEM-privileged delete operation to an arbitrary target directory.

The scheduled task can be triggered through multiple mechanisms including the WnfStateChangeTrigger (specifically RecallPolicyCheckUpdateTrigger), AADStatusChangeTrigger, DisableAIDataAnalysisTrigger, UserLoginTrigger, and SessionUnlockTrigger. The RecallPolicyCheckUpdateTrigger via Windows Notification Facility (WNF) state changes provides the most reliable trigger mechanism for exploitation.

The attack chain proceeds as follows: (1) The attacker obtains a local foothold on the target system with standard user privileges. (2) The attacker creates the CoreAIPlatform.00\UKP directory structure in their %LOCALAPPDATA% if it does not already exist. (3) The attacker creates a GUID-named junction point within the UKP directory pointing to a sensitive system directory (e.g., C:\Windows\System32\config or a protected service directory). (4) The attacker triggers the PolicyConfiguration scheduled task via WNF state change or waits for a natural trigger event such as user login or session unlock. (5) taskhostw.exe, running as SYSTEM, resolves the junction and deletes the target directory, enabling further exploitation such as DLL planting, service configuration manipulation, or security control bypass.

The arbitrary folder deletion primitive can be escalated to full SYSTEM code execution through well-known techniques such as replacing deleted system binaries, manipulating Windows Installer rollback directories, or exploiting service recovery mechanisms that reference the deleted paths.

The vulnerability affects Windows 11 24H2 (builds prior to 10.0.26100.7462), Windows 11 25H2 (builds prior to 10.0.26200.7462), and Windows Server 2025 (builds prior to 10.0.26100.7462) including Server Core installations. Microsoft patched the vulnerability in the November 2025 Patch Tuesday release, with additional patches in December 2025 (KB5072033, KB5072014 hotpatch). Despite being patched for five months, CISA confirmed active exploitation in April 2026, indicating significant patching gaps in enterprise environments.

The EPSS score of 0.18238 (95th percentile) reflects high exploitation probability. Four public proof-of-concept exploits are available on GitHub, with the most notable being the redpack-kr/CVE-2025-60710 repository containing C/C++ exploit code. The combination of low attack complexity, no user interaction requirement, public PoC availability, and confirmed active exploitation makes this a critical priority for patching.

## MITRE ATT&CK

- T1068 Exploitation for Privilege Escalation
- T1053 Scheduled Task/Job
- T1211 Exploitation for Stealth
- T1070 Indicator Removal
- T1574 Hijack Execution Flow
- T1485 Data Destruction
- T1083 File and Directory Discovery
- T1569 System Services

## Sources

- [NVD - CVE-2025-60710](https://nvd.nist.gov/vuln/detail/CVE-2025-60710)
- [Microsoft Security Update Guide - CVE-2025-60710](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-60710)
- [CISA Adds Seven Known Exploited Vulnerabilities to Catalog (includes CVE-2025-60710)](https://www.cisa.gov/news-events/alerts/2026/04/13/cisa-adds-seven-known-exploited-vulnerabilities-catalog)
- [CISA Known Exploited Vulnerabilities Catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)
- [BleepingComputer - CISA flags Windows Task Host vulnerability as exploited in attacks](https://www.bleepingcomputer.com/news/security/cisa-flags-windows-task-host-vulnerability-as-exploited-in-attacks/)
- [redpack-kr/CVE-2025-60710 - Proof of Concept Exploit](https://github.com/redpack-kr/CVE-2025-60710)
- [Rapid7 Vulnerability Database - CVE-2025-60710](https://www.rapid7.com/db/vulnerabilities/microsoft-windows-cve-2025-60710/)
- [CVEFeed - CVE-2025-60710 Detail](https://cvefeed.io/vuln/detail/CVE-2025-60710)
- [CIRCL Vulnerability Lookup - CVE-2025-60710](https://vulnerability.circl.lu/vuln/CVE-2025-60710)
- [AttackerKB - CVE-2025-60710](https://attackerkb.com/topics/CVE-2025-60710)
- [Vicarius - CVE-2025-60710 Mitigation Script](https://www.vicarius.io/vsociety/posts/cve-2025-60710-mitigation-script-eop-vulnerability-in-host-process-for-windows-tasks)
- [ThreatINT - CVE-2025-60710](https://cve.threatint.eu/CVE/CVE-2025-60710)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0370