NewsCompaniesFlawsGuides
Get the app
HighFixedBeing used in attacksUpdated

Windows flaws CVE-2023-36424 and CVE-2025-60710 exploited; Task Host flaw used in ransomware

Two patched Windows flaws let attackers who already have access gain greater control. CISA confirmed exploitation in April and later flagged ransomware use of CVE-2025-60710. Install current Windows security updates and restart.

What to do

Open Settings → Windows Update, check for updates, install available security updates and restart. Ask whoever manages work computers and servers to verify the fixed build for each Windows release; use Microsoft's current build thresholds below rather than relying only on an update's month.

Check your devices
  • Windows 11 version 21H2fixed in 10.0.22000.2600 and later
  • Windows 11 version 22H2fixed in 10.0.22621.2715 and later
  • Windows 11 version 23H2fixed in 10.0.22631.2715 and later
  • Windows 11 version 24H2fixed in 10.0.26100.7462 and later
  • Windows 11 version 25H2fixed in 10.0.26200.7462 and later
  • Windows 10 version 1507fixed in 10.0.10240.20308 and later
  • Windows 10 version 1607fixed in 10.0.14393.6452 and later
  • Windows 10 version 1809fixed in 10.0.17763.5122 and later
  • Windows 10 version 22H2fixed in 10.0.19045.3693 and later

What’s happening

These two Windows flaws can help an attacker who already has access to a computer gain higher privileges. CVE-2023-36424 affects the Common Log File System driver across Windows 10, Windows 11 and several Windows Server releases. CVE-2025-60710 affects Host Process for Windows Tasks in Windows 11 24H2 and 25H2 and Windows Server 2025; exploitation can give an attacker full system control. CISA listed both as exploited on 13 April 2026. By August it also confirmed ransomware use of CVE-2025-60710; ransomware use of CVE-2023-36424 remains unknown. Fixes are available for both. Microsoft told BleepingComputer the Task Host flaw was addressed in November 2025, while The Register reported a complete fix in December. Microsoft's current published build thresholds are the safest minimums to check against. As of 3 November, both remain on CISA's exploited list; the reviewed sources do not establish that attacks have ended.

What
Flaw
Affects
Microsoft Windows 10, Windows 11 and Windows Server
Affected
CVE-2023-36424 — Windows 11 version 21H2: below 10.0.22000.2600
CVE-2023-36424 — Windows 11 version 22H2: below 10.0.22621.2715
CVE-2023-36424 — Windows 11 Version 23H2 (x64): below 10.0.22631.2715; Microsoft labels the corresponding ARM64 entry 'Windows 11 version 22H3'
CVE-2023-36424 — Windows 10 Version 1507: below 10.0.10240.20308
CVE-2023-36424 — Windows 10 Version 1607: below 10.0.14393.6452
CVE-2023-36424 — Windows 10 Version 1809: below 10.0.17763.5122
CVE-2023-36424 — Windows 10 Version 21H2: Microsoft lists below 10.0.19043.3693, an inconsistent version/build pairing that needs vendor clarification
CVE-2023-36424 — Windows 10 Version 22H2: below 10.0.19045.3693
CVE-2023-36424 — Windows Server 2008 Service Pack 2, including Server Core: below 6.0.6003.22367
CVE-2023-36424 — Windows Server 2008 R2 Service Pack 1, including Server Core: below 6.1.7601.26816
CVE-2023-36424 — Windows Server 2012, including Server Core: below 6.2.9200.24569
CVE-2023-36424 — Windows Server 2012 R2, including Server Core: below 6.3.9600.21668
CVE-2023-36424 — Windows Server 2016, including Server Core: below 10.0.14393.6452
CVE-2023-36424 — Windows Server 2019, including Server Core: below 10.0.17763.5122
CVE-2023-36424 — Windows Server 2022: below 10.0.20348.2113
CVE-2023-36424 — Windows Server 2022, 23H2 Edition (Server Core installation): below 10.0.25398.531
CVE-2025-60710 — Windows 11 Version 24H2: below 10.0.26100.7462
CVE-2025-60710 — Windows 11 Version 25H2: below 10.0.26200.7462
CVE-2025-60710 — Windows Server 2025, including Server Core: below 10.0.26100.7462
Fixed in
CVE-2023-36424 — Windows 11 21H2: 10.0.22000.2600
CVE-2023-36424 — Windows 11 22H2: 10.0.22621.2715
CVE-2023-36424 — Windows 11 23H2 and Microsoft's ARM64 entry labelled '22H3': 10.0.22631.2715
CVE-2023-36424 — Windows 10 1507: 10.0.10240.20308
CVE-2023-36424 — Windows 10 1607: 10.0.14393.6452
CVE-2023-36424 — Windows 10 1809: 10.0.17763.5122
CVE-2023-36424 — Microsoft lists 10.0.19043.3693 for Windows 10 21H2; verify this inconsistent branch label with Microsoft before using it for device matching
CVE-2023-36424 — Windows 10 22H2: 10.0.19045.3693
CVE-2023-36424 — Windows Server 2008 SP2, including Server Core: 6.0.6003.22367
CVE-2023-36424 — Windows Server 2008 R2 SP1, including Server Core: 6.1.7601.26816
CVE-2023-36424 — Windows Server 2012, including Server Core: 6.2.9200.24569
CVE-2023-36424 — Windows Server 2012 R2, including Server Core: 6.3.9600.21668
CVE-2023-36424 — Windows Server 2016, including Server Core: 10.0.14393.6452
CVE-2023-36424 — Windows Server 2019, including Server Core: 10.0.17763.5122
CVE-2023-36424 — Windows Server 2022: 10.0.20348.2113
CVE-2023-36424 — Windows Server 2022, 23H2 Edition (Server Core installation): 10.0.25398.531
CVE-2025-60710 — Windows 11 24H2: 10.0.26100.7462
CVE-2025-60710 — Windows 11 25H2: 10.0.26200.7462
CVE-2025-60710 — Windows Server 2025, including Server Core: 10.0.26100.7462
CVE
CVE-2023-36424, CVE-2025-60710
Since
13 Apr 2026

Timeline

  1. Update

    CISA's current catalogue continues to list both flaws as exploited. Ransomware use is recorded as known for CVE-2025-60710 and unknown for CVE-2023-36424.

  2. Update

    Microsoft tells BleepingComputer that its November 2025 security updates addressed CVE-2025-60710 and that customers who installed them are protected. This differs from The Register's April account, which placed the complete fix in December 2025.

  3. Wider attacks

    BleepingComputer reports that CISA has additionally flagged CVE-2025-60710 as used in ransomware campaigns. CISA has not disclosed the attackers or details of those attacks.

  4. CISA added

    CISA adds both flaws to its Known Exploited Vulnerabilities catalogue, confirming their use in attacks. US federal civilian agencies are given until 27 April to remediate.

  5. Vendor revisedFixed

    Microsoft's revised CVE-2025-60710 record identifies affected builds below 26100.7462 for Windows 11 24H2 and Windows Server 2025, and below 26200.7462 for Windows 11 25H2.

  6. Made public

    Microsoft discloses CVE-2025-60710 in Host Process for Windows Tasks. It lets an attacker with an existing local account gain higher privileges on affected Windows 11 and Windows Server 2025 machines.

  7. Made public

    Microsoft publishes CVE-2023-36424, a privilege-escalation flaw in the Windows Common Log File System driver. Fixes were released in November 2023.

Sources

  1. Microsoft's published CVE-2023-36424 recordMicrosoft · 14 Nov 2023
  2. Microsoft's published CVE-2025-60710 recordMicrosoft · 11 Nov 2025
  3. Known Exploited Vulnerabilities catalogue, 3 November 2026CISA · 3 Nov 2026
  4. Zombie Microsoft bugs rise from the dead, pave way for crims and ransomware scumThe Register · 13 Apr 2026
  5. CISA: Windows Task Host flaw now exploited by ransomware gangsBleepingComputer · 19 Aug 2026
HARD Live follows this until it’s over: each change is added to the timeline with its source. Everything live · Everything from April 2026 · JSON · RSS