Veille CVE
CVE-2025-60710
7.8 Élevée Exploitée activement Utilisée par des rançongicielsCatalogue CISA KEV — Microsoft Windows Link Following Vulnerability
Ajoutée le 13/04/2026 · Échéance de correction (agences US) : 27/04/2026
Action requise : Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Description
Improper link resolution before file access ('link following') in Host Process for Windows Tasks allows an authorized attacker to elevate privileges locally.
Produits concernés
Scores CVSS
| Version | Score | Source | Vecteur |
|---|---|---|---|
| 3.1 | 7.8 Élevée | secure@microsoft.com | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Faiblesses (CWE)
Références
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-60710 Vendor Advisory
- https://www.vicarius.io/vsociety/posts/cve-2025-60710-detection-script-eop-vulnerability-in-host-process-for-windows-tasks Third Party Advisory
- https://www.vicarius.io/vsociety/posts/cve-2025-60710-mitigation-script-eop-vulnerability-in-host-process-for-windows-tasks MitigationThird Party Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-60710 US Government Resource