{"id":"windows-two-exploited-flaws-apr-2026","category":"patch","status":"live","title":"Windows flaws CVE-2023-36424 and CVE-2025-60710 exploited; Task Host flaw used in ransomware","tldr":"Two patched Windows flaws let attackers who already have access gain greater control. CISA confirmed exploitation in April and later flagged ransomware use of CVE-2025-60710. Install current Windows security updates and restart.","summary":"These two Windows flaws can help an attacker who already has access to a computer gain higher privileges. CVE-2023-36424 affects the Common Log File System driver across Windows 10, Windows 11 and several Windows Server releases. CVE-2025-60710 affects Host Process for Windows Tasks in Windows 11 24H2 and 25H2 and Windows Server 2025; exploitation can give an attacker full system control. CISA listed both as exploited on 13 April 2026. By August it also confirmed ransomware use of CVE-2025-60710; ransomware use of CVE-2023-36424 remains unknown. Fixes are available for both. Microsoft told BleepingComputer the Task Host flaw was addressed in November 2025, while The Register reported a complete fix in December. Microsoft's current published build thresholds are the safest minimums to check against. As of 3 November, both remain on CISA's exploited list; the reviewed sources do not establish that attacks have ended.","action":"Open Settings → Windows Update, check for updates, install available security updates and restart. Ask whoever manages work computers and servers to verify the fixed build for each Windows release; use Microsoft's current build thresholds below rather than relying only on an update's month.","product":"Microsoft Windows 10, Windows 11 and Windows Server","audience":"both","severity":"high","patch":"patched","exploited":true,"cves":["CVE-2023-36424","CVE-2025-60710"],"tags":["microsoft","windows","windows-server","privilege-escalation","ransomware","actively-exploited"],"affected":["CVE-2023-36424 — Windows 11 version 21H2: below 10.0.22000.2600","CVE-2023-36424 — Windows 11 version 22H2: below 10.0.22621.2715","CVE-2023-36424 — Windows 11 Version 23H2 (x64): below 10.0.22631.2715; Microsoft labels the corresponding ARM64 entry 'Windows 11 version 22H3'","CVE-2023-36424 — Windows 10 Version 1507: below 10.0.10240.20308","CVE-2023-36424 — Windows 10 Version 1607: below 10.0.14393.6452","CVE-2023-36424 — Windows 10 Version 1809: below 10.0.17763.5122","CVE-2023-36424 — Windows 10 Version 21H2: Microsoft lists below 10.0.19043.3693, an inconsistent version/build pairing that needs vendor clarification","CVE-2023-36424 — Windows 10 Version 22H2: below 10.0.19045.3693","CVE-2023-36424 — Windows Server 2008 Service Pack 2, including Server Core: below 6.0.6003.22367","CVE-2023-36424 — Windows Server 2008 R2 Service Pack 1, including Server Core: below 6.1.7601.26816","CVE-2023-36424 — Windows Server 2012, including Server Core: below 6.2.9200.24569","CVE-2023-36424 — Windows Server 2012 R2, including Server Core: below 6.3.9600.21668","CVE-2023-36424 — Windows Server 2016, including Server Core: below 10.0.14393.6452","CVE-2023-36424 — Windows Server 2019, including Server Core: below 10.0.17763.5122","CVE-2023-36424 — Windows Server 2022: below 10.0.20348.2113","CVE-2023-36424 — Windows Server 2022, 23H2 Edition (Server Core installation): below 10.0.25398.531","CVE-2025-60710 — Windows 11 Version 24H2: below 10.0.26100.7462","CVE-2025-60710 — Windows 11 Version 25H2: below 10.0.26200.7462","CVE-2025-60710 — Windows Server 2025, including Server Core: below 10.0.26100.7462"],"fixed":["CVE-2023-36424 — Windows 11 21H2: 10.0.22000.2600","CVE-2023-36424 — Windows 11 22H2: 10.0.22621.2715","CVE-2023-36424 — Windows 11 23H2 and Microsoft's ARM64 entry labelled '22H3': 10.0.22631.2715","CVE-2023-36424 — Windows 10 1507: 10.0.10240.20308","CVE-2023-36424 — Windows 10 1607: 10.0.14393.6452","CVE-2023-36424 — Windows 10 1809: 10.0.17763.5122","CVE-2023-36424 — Microsoft lists 10.0.19043.3693 for Windows 10 21H2; verify this inconsistent branch label with Microsoft before using it for device matching","CVE-2023-36424 — Windows 10 22H2: 10.0.19045.3693","CVE-2023-36424 — Windows Server 2008 SP2, including Server Core: 6.0.6003.22367","CVE-2023-36424 — Windows Server 2008 R2 SP1, including Server Core: 6.1.7601.26816","CVE-2023-36424 — Windows Server 2012, including Server Core: 6.2.9200.24569","CVE-2023-36424 — Windows Server 2012 R2, including Server Core: 6.3.9600.21668","CVE-2023-36424 — Windows Server 2016, including Server Core: 10.0.14393.6452","CVE-2023-36424 — Windows Server 2019, including Server Core: 10.0.17763.5122","CVE-2023-36424 — Windows Server 2022: 10.0.20348.2113","CVE-2023-36424 — Windows Server 2022, 23H2 Edition (Server Core installation): 10.0.25398.531","CVE-2025-60710 — Windows 11 24H2: 10.0.26100.7462","CVE-2025-60710 — Windows 11 25H2: 10.0.26200.7462","CVE-2025-60710 — Windows Server 2025, including Server Core: 10.0.26100.7462"],"matches":[{"platform":"windows","app":"Windows 11 version 21H2","bundle":"","fixed":"10.0.22000.2600"},{"platform":"windows","app":"Windows 11 version 22H2","bundle":"","fixed":"10.0.22621.2715"},{"platform":"windows","app":"Windows 11 version 23H2","bundle":"","fixed":"10.0.22631.2715"},{"platform":"windows","app":"Windows 11 version 24H2","bundle":"","fixed":"10.0.26100.7462"},{"platform":"windows","app":"Windows 11 version 25H2","bundle":"","fixed":"10.0.26200.7462"},{"platform":"windows","app":"Windows 10 version 1507","bundle":"","fixed":"10.0.10240.20308"},{"platform":"windows","app":"Windows 10 version 1607","bundle":"","fixed":"10.0.14393.6452"},{"platform":"windows","app":"Windows 10 version 1809","bundle":"","fixed":"10.0.17763.5122"},{"platform":"windows","app":"Windows 10 version 22H2","bundle":"","fixed":"10.0.19045.3693"}],"sources":[{"kind":"advisory","title":"Microsoft's published CVE-2023-36424 record","url":"https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36424.json","by":"Microsoft","date":"2023-11-14"},{"kind":"advisory","title":"Microsoft's published CVE-2025-60710 record","url":"https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/60xxx/CVE-2025-60710.json","by":"Microsoft","date":"2025-11-11"},{"kind":"advisory","title":"Known Exploited Vulnerabilities catalogue, 3 November 2026","url":"https://raw.githubusercontent.com/cisagov/kev-data/main/known_exploited_vulnerabilities.json","by":"CISA","date":"2026-11-03"},{"kind":"news","title":"Zombie Microsoft bugs rise from the dead, pave way for crims and ransomware scum","url":"https://www.theregister.com/security/2026/04/13/ransomware-scum-other-crims-exploit-4-old-microsoft-bugs/5222887","by":"The Register","date":"2026-04-13"},{"kind":"news","title":"CISA: Windows Task Host flaw now exploited by ransomware gangs","url":"https://www.bleepingcomputer.com/news/security/cisa-windows-task-host-flaw-now-exploited-by-ransomware-gangs/amp/","by":"BleepingComputer","date":"2026-08-19"}],"started":"2026-04-13","closed":null,"created":"2026-11-03T22:05:24.793Z","updated":"2026-11-03T22:05:24.793Z","cve_notes":[{"cve":"CVE-2023-36424","name":"Privilege escalation in Windows CLFS driver","what":"The Windows Common Log File System driver can read outside its intended memory boundaries, allowing an attacker with local access to gain higher privileges.","severity":"high","cvss":7.8},{"cve":"CVE-2025-60710","name":"Link-following flaw in Windows Task Host","what":"Host Process for Windows Tasks handles file links incorrectly, allowing an attacker with an existing local account to gain higher privileges and potentially full system control.","severity":"high","cvss":7.8}],"timeline":[{"at":"2026-11-03","added":"2026-11-03T22:00:26.134Z","kind":"other","text":"CISA's current catalogue continues to list both flaws as exploited. Ransomware use is recorded as known for CVE-2025-60710 and unknown for CVE-2023-36424.","url":"https://raw.githubusercontent.com/cisagov/kev-data/main/known_exploited_vulnerabilities.json","by":"CISA","patch":null},{"at":"2026-08-19","added":"2026-11-03T22:00:26.134Z","kind":"other","text":"Microsoft tells BleepingComputer that its November 2025 security updates addressed CVE-2025-60710 and that customers who installed them are protected. This differs from The Register's April account, which placed the complete fix in December 2025.","url":"https://www.bleepingcomputer.com/news/security/cisa-windows-task-host-flaw-now-exploited-by-ransomware-gangs/amp/","by":"BleepingComputer","patch":null},{"at":"2026-08-18","added":"2026-11-03T22:00:26.134Z","kind":"wider-attacks","text":"BleepingComputer reports that CISA has additionally flagged CVE-2025-60710 as used in ransomware campaigns. CISA has not disclosed the attackers or details of those attacks.","url":"https://www.bleepingcomputer.com/news/security/cisa-windows-task-host-flaw-now-exploited-by-ransomware-gangs/amp/","by":"BleepingComputer","patch":null},{"at":"2026-04-13","added":"2026-11-03T22:00:26.134Z","kind":"cisa-added","text":"CISA adds both flaws to its Known Exploited Vulnerabilities catalogue, confirming their use in attacks. US federal civilian agencies are given until 27 April to remediate.","url":"https://raw.githubusercontent.com/cisagov/kev-data/main/known_exploited_vulnerabilities.json","by":"CISA","patch":null},{"at":"2026-02-13","added":"2026-11-03T22:00:26.134Z","kind":"vendor-revised","text":"Microsoft's revised CVE-2025-60710 record identifies affected builds below 26100.7462 for Windows 11 24H2 and Windows Server 2025, and below 26200.7462 for Windows 11 25H2.","url":"https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/60xxx/CVE-2025-60710.json","by":"Microsoft","patch":"patched"},{"at":"2025-11-11","added":"2026-11-03T22:00:26.134Z","kind":"disclosed","text":"Microsoft discloses CVE-2025-60710 in Host Process for Windows Tasks. It lets an attacker with an existing local account gain higher privileges on affected Windows 11 and Windows Server 2025 machines.","url":"https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/60xxx/CVE-2025-60710.json","by":"Microsoft","patch":null},{"at":"2023-11-14","added":"2026-11-03T22:00:26.134Z","kind":"disclosed","text":"Microsoft publishes CVE-2023-36424, a privilege-escalation flaw in the Windows Common Log File System driver. Fixes were released in November 2023.","url":"https://www.theregister.com/security/2026/04/13/ransomware-scum-other-crims-exploit-4-old-microsoft-bugs/5222887","by":"The Register","patch":null}],"url":"https://hard.fyi/live/windows-two-exploited-flaws-apr-2026/","json":"https://hard.fyi/api/live?id=windows-two-exploited-flaws-apr-2026"}