CVE-2025-60710

HighCVSS 7.8/10Known exploited (CISA KEV)Last modified Oct 18, 2026

Description

Improper link resolution before file access ('link following') in Host Process for Windows Tasks allows an authorized attacker to elevate privileges locally.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-59

Affected software

No affected versions have been published.

Timeline

Published
Nov 11, 2025
Last modified
Oct 18, 2026
Added to CISA KEV
Apr 13, 2026
NVD status
Analyzed

Related CVEs from 2025

CVE-2025-607116.3Protection mechanism failure in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.CVE-2025-607137.8Untrusted pointer dereference in Windows Routing and Remote Access Service (RRAS) allows an authorized attacker to elevate privileges locallCVE-2025-607147.8Heap-based buffer overflow in Windows OLE allows an unauthorized attacker to execute code locally.CVE-2025-607158.0Heap-based buffer overflow in Windows Routing and Remote Access Service (RRAS) allows an authorized attacker to execute code over a network.CVE-2025-607167.0Use after free in Windows DirectX allows an authorized attacker to elevate privileges locally.CVE-2025-607177.0Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally.CVE-2025-607187.8Untrusted search path in Windows Administrator Protection allows an authorized attacker to elevate privileges locally.CVE-2025-607197.0Untrusted pointer dereference in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.CVE-2025-60727.5Stack-based Buffer Overflow vulnerability in ABB RMC-100, ABB RMC-100 LITE. When the REST interface is enabled by the user, and an attackCVE-2025-607207.8Buffer over-read in Windows TDX.sys allows an authorized attacker to elevate privileges locally.CVE-2025-607217.8Privilege context switching error in Windows Administrator Protection allows an authorized attacker to elevate privileges locally.CVE-2025-607226.5Improper limitation of a pathname to a restricted directory ('path traversal') in OneDrive for Android allows an authorized attacker to elev
CVE-2025-60710: High severity, CVSS 7.8 | Vulnix