CVE-2025-60710 Technical Vulnerability Analysis & Patch Advisory (CVSS 7.8)

Affected Vendors

security-advisory

Affected Components

enterprise-software

Published Date

2025-11-11

Executive & SecOps Summary

SECOPS ASSESSMENT

Affected Scope

Systems running unpatched versions impacted by CVE-2025-60710

Impact

Improper link resolution before file access ('link following') in Host Process for Windows Tasks allows an authorized attacker to elevate pr...

Mitigation

Apply vendor security patches and restrict external network exposure.

Affected Products & Version Scope

All unpatched versions listed in the official NVD CPE configurations

Remediation & Live Workaround Commands

PATCH & WORKAROUND

Remediation Steps

Upgrade to the latest patched release from the vendor.
Apply virtual patching or network segmentation until maintenance windows allow full patching.

Recommended Security Control & Mitigation Partner

SentinelOne Singularity AI EDR

Reduce your attack surface immediately with automated vulnerability scanning and runtime protection.

Block Kernel Privilege Escalation & Ransomware Payloads Before You Can Reboot

Protect unpatched Windows, Linux, and macOS workloads against in-memory exploitation and lateral movement with autonomous EDR.

100% MITRE ATT&CK Detection · 1-Click Rollback

See Autonomous Endpoint Protection in Action

Technical Root Cause & Exploitation Mechanics

Technical Overview

Improper link resolution before file access ('link following') in Host Process for Windows Tasks allows an authorized attacker to elevate privileges locally.

CVSS Score: 7.8 (HIGH)
CWE IDs: CWE-59

Official Vendor Advisories & References

NVD Original English Description

Improper link resolution before file access ('link following') in Host Process for Windows Tasks allows an authorized attacker to elevate privileges locally.

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-60710

Source: secure@microsoft.com · Vendor Advisory

https://www.vicarius.io/vsociety/posts/cve-2025-60710-detection-script-eop-vulnerability-in-host-process-for-windows-tasks

Source: af854a3a-2127-422b-91ae-364da2661108 · Third Party Advisory

https://www.vicarius.io/vsociety/posts/cve-2025-60710-mitigation-script-eop-vulnerability-in-host-process-for-windows-tasks

Source: af854a3a-2127-422b-91ae-364da2661108 · Mitigation, Third Party Advisory

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-60710

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 · US Government Resource

SecOps Advisory Dispatch & RSS Feed

Subscribe to Daily Vulnerability Briefings & KEV Alerts

Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.

Slack / Teams / RSS Feed: