The Windows Ransomware Warning and the Second Door Attackers Use

A burglar gets into a small office using a stolen keycard. Once inside, the burglar finds that every cupboard, safe, and locked room accepts the same weak maintenance key. The stolen keycard was the first failure. The maintenance key turns one stolen account into control of the whole building.

That is the useful way to read this week’s Windows ransomware warning. On 17 August 2026, the US Cybersecurity and Infrastructure Security Agency updated its public catalogue to say that CVE-2025-60710 has been used in known ransomware campaigns. The flaw affects the Windows process that runs background tasks. It can let somebody who already has a foothold on an affected computer climb from an ordinary account to Windows’ most powerful local account.

The flaw did not suddenly appear this week. Microsoft released its security fix on 11 November 2025, and CISA first placed the vulnerability in its Known Exploited Vulnerabilities catalogue on 13 April 2026. The fresh fact is the ransomware connection. BleepingComputer reported the change on 18 August, while also noting that CISA has not named the group, victims, or attacks behind that label.

Here is the reassuring part. This vulnerability is a second door, not a magic route from anywhere on the internet into every Windows PC. An attacker needs local access with some permission before the flaw helps. A current Windows installation closes this particular route. For most people, the right response is to finish Windows Update, restart if asked, and spend five minutes checking whether updates have actually been completing.

What changed this week, and what did not

CISA maintains a catalogue of vulnerabilities with evidence of use in real attacks. Its catalogue page describes the list as an authoritative source of flaws exploited in the wild, rather than a ranking of every possible software weakness. CVE-2025-60710 entered that catalogue in April 2026. In the catalogue release dated 17 August, its “known ransomware campaign use” field reads “Known.”

That field carries a narrow but important claim. CISA created the ransomware marker so defenders could see which already exploited vulnerabilities also have a connection to ransomware activity. It does not identify a criminal group, count affected computers, describe how the criminals first arrived, or prove that this one flaw was present in every attack. As of 18 August, neither the catalogue entry nor Microsoft’s advisory supplies those missing details.

The restraint matters because a headline can easily turn “used during a ransomware campaign” into “ransomware can enter any Windows computer through this flaw.” Those are different stories. Microsoft’s technical assessment says the attack vector is local, requires low privileges, and needs no further click from the user once the attacker is in that position. In ordinary language, the criminal needs a handhold on the computer before using this particular ladder.

Microsoft published its advisory for CVE-2025-60710 on 11 November 2025. It classed the flaw as “Important,” scored it 7.8 out of 10, and described the effect as elevation of privilege. The National Vulnerability Database lists the affected products as Windows 11 versions 24H2 and 25H2, plus Windows Server 2025, including its Server Core installation. Windows 10 is not listed in that affected set.

CISA’s entry also tells US federal agencies to apply the vendor’s fix and gave them a deadline of 27 April 2026. That deadline is an instruction for federal systems, not a countdown for home users. Its value for the rest of us is simpler: a government security agency has enough evidence of real exploitation to move this patch out of the “perhaps one day” pile.

Independent reporting in April helps fix the timeline. The Register reported on 13 April that CISA had added the flaw to the catalogue and that Microsoft had revised the fix after the original November release. That history is one reason “I installed some updates last autumn” is a poor test. Windows cumulative updates carry later corrections forward. A computer that is current now receives the repaired code without its owner reconstructing every revision from 2025.

The facts support a firm position without panic. Finish the updates. Do not spend the evening searching for a named ransomware gang that the agencies have not named, and do not download a mystery “CVE scanner” from an advert. The ordinary update route is both safer and more useful.

The first door and the second door

Ransomware is the visible end of a longer chain. Before criminals can scramble files and demand money, they normally need a way into a computer or account, enough control to run their tools, and some path to the files they want to steal or encrypt. Different weaknesses serve different parts of that chain.

A stolen password can be a first door. So can a malicious attachment, an exposed remote-access service, a fake support call, or an unpatched program that accepts requests from the internet. CVE-2025-60710 is different. Microsoft’s own scoring says the attacker must already be local and hold a low-privilege account. The flaw helps after arrival by raising the attacker’s authority on that Windows machine.

Windows gives different accounts different powers for the same reason a building gives visitors, staff, and facilities managers different keys. An ordinary user can open their own files and run permitted programs. An administrator can install software and change wider settings. The built-in SYSTEM identity sits higher still because Windows services need deep control to keep the operating system working.

That separation limits damage when it holds. Imagine that a malicious download runs under your ordinary account. It may be able to read files you can read, but it should not automatically rewrite protected operating-system areas or take control of every service. An elevation-of-privilege flaw offers a route past that barrier. In this case, Microsoft says successful exploitation can have a high effect on confidentiality, integrity, and availability.

The distinction explains why a user may never see a dramatic first step. The initial foothold could be small and quiet. Once the intruder reaches SYSTEM, security tools can be harder to resist, hidden changes become easier to make, and data belonging to other users may come within reach. The second door turns a limited break-in into a much larger repair job.

A useful home example starts with a teenager’s gaming PC. Suppose a fake game mod runs under the teenager’s account. Good account separation should keep that program away from some protected parts of Windows and from another family member’s account. A local privilege flaw can help the program reach the master key. The ransomware warning tells us criminals value that climb; it does not tell us that the flaw downloaded the fake mod in the first place.

A small business has more at stake. One unprivileged account on a reception PC may still reach shared folders, printers, cloud sessions, and saved connection details. SYSTEM rights on the PC can give an attacker a stronger base from which to steal credentials or tamper with tools used by the business. Whether the attack then spreads depends on the network, account design, backups, and other controls. One Windows flaw does not erase every boundary automatically, but weak boundaries can make the climb much more expensive.

This is also why changing a password after an infection may be necessary but incomplete. The password may close the first route while malicious software keeps a second route open. A machine that has genuinely been taken over needs a trustworthy cleanup or rebuild, followed by credential changes from a clean device. Password advice belongs to the entry problem; patching and recovery belong to the control problem.

How a background task follows the wrong signpost

The affected component is called Host Process for Windows Tasks, commonly seen as taskhostw.exe. It is a legitimate part of Windows that helps run background work packaged in system libraries. Seeing that name in Task Manager is normal. The name alone is not evidence of infection, and ending the process at random can interrupt ordinary Windows work without removing an attacker.

Microsoft describes the programming mistake as “improper link resolution before file access,” also known as link following. A link in a file system acts like a signpost. A program believes it is opening or changing one place, but the signpost can direct that operation somewhere else. Trouble follows when a less trusted user can arrange the signpost while a more trusted process performs the operation.

Picture a maintenance worker who has permission to replace a notice on the lobby board. Somebody quietly swaps the label on the worker’s clipboard so it points to the payroll safe. If the worker follows the label without checking the final destination, a small permission has been borrowed to touch a protected place. The attacker does not gain the worker’s master key directly; the attacker gets the worker to use it on the wrong target.

That is the family of weakness recorded as CWE-59. The public advisories do not provide a step-by-step exploit, and a home user does not need one to act. The important mechanism is the trust mismatch: an attacker controls where a file operation points, while a Windows process with greater authority carries out the operation. Microsoft corrected that behaviour through Windows Update.

A local elevation flaw can be severe even though it does not work from across the internet by itself. Criminals often combine weaknesses. The first technique gets code running with modest rights; the second grants powerful rights; later tools search for valuable data, connected accounts, and backups. Defenders split those steps apart because each separation offers another chance to stop the chain.

This layered view prevents two common mistakes. The first is dismissing a local flaw because “they already have to be inside.” Limited access and SYSTEM access have very different consequences. The second is treating the flaw as a complete explanation for a ransomware incident. A ladder inside the house matters, but investigators still need to find the broken window that put the burglar beside it.

For most readers, the mechanism lands on one practical point: do not try to hunt taskhostw.exe. Apply the update that changes how the trusted process handles the signpost. Antivirus scans and account reviews may matter after a suspected incident, but deleting or blocking a core Windows process is not a safe substitute for Microsoft’s repair.

Why an update from last year can still deserve attention

Microsoft fixed CVE-2025-60710 in the November 2025 security release, then revised its information in December. By April 2026, CISA had evidence of exploitation. By 17 August, the catalogue marked ransomware campaign use as known. That sequence shows the long life of an uninstalled patch.

Software flaws do not expire when the news moves on. A criminal can keep using a known route against machines that missed the update, could not restart, fell out of management, or were restored from an old image. Public knowledge can make an older flaw easier to reuse because defenders and attackers both have time to study it. The date on the advisory describes when the repair became available, not when every computer became safe.

Windows updates are cumulative on supported versions. You generally do not need to locate the exact November package and install eleven months of patches by hand. Running the current supported release and completing today’s cumulative update should include earlier security corrections. Microsoft’s Windows Update guidance says Windows 11 automatically downloads and installs updates, while still allowing you to check manually under Start, Settings, Windows Update.

“Automatic” still leaves room for failure. A laptop may spend weeks asleep in a bag. A restart can be postponed each evening. A nearly full drive can interrupt installation. A small office may discover that one PC no longer reports to its management service. A person may pause updates during travel and forget to resume them.

The useful check is completion, not intention. Open Windows Update and look for a current status. Install what is offered, then restart when required. Return to the same page afterward because some updates only appear once an earlier package or restart has completed. Update history can confirm that quality and security updates have been landing rather than failing repeatedly.

Version support matters as much as this one CVE. A perfectly installed final patch cannot protect an operating-system release after it stops receiving new fixes. Microsoft’s product lifecycle and Windows Update pages are the right sources for that decision, not pop-up adverts that claim your PC has hundreds of urgent problems. If Windows says the hardware cannot move to a supported release, plan the replacement rather than buying a registry cleaner.

The affected list also gives some readers permission to stop. NVD names Windows 11 24H2, Windows 11 25H2, and Windows Server 2025. A supported Windows PC outside that list is not named as vulnerable to CVE-2025-60710. It still needs current updates because other flaws exist, but you do not need to bend the evidence to make this one apply.

Businesses should read “current” more strictly. A dashboard showing 98 percent patched can hide the two machines that matter most: the reception desk everyone uses and the old accounts PC that holds local archives. A server image may be patched while a recovery template remains stale. The test should ask which live or restorable systems run affected builds, when they last checked in, and whether a reboot completed the update.

What the ransomware label does and does not prove

CISA’s ransomware marker gives patching teams a reason to move this flaw upward. It says observed criminal activity has crossed beyond generic exploitation into a ransomware context. For a person at home, it reinforces the value of an update that should already be installed. For a business, it supports a faster search for missing endpoints and a review of any affected machine with signs of intrusion.

The marker does not tell us how often the flaw was used. CISA’s public row supplies no victim count, country list, ransomware family, entry route, or dates of the associated incidents. BleepingComputer says the agency had not shared attack details when its 18 August report was published. Microsoft had not responded to that outlet before publication, according to the report.

We should leave those blanks empty. Naming a fashionable ransomware group would create a neat story without evidence. Claiming a mass campaign would turn a categorical field into a population estimate. Suggesting that every affected Windows machine has already been scanned would confuse possibility with observation.

The absence of detail does not weaken the update advice because the patch has almost no mystery for an ordinary user. Microsoft published it through the standard channel. CISA has confirmed exploitation and now ransomware use. The action remains proportional: complete Windows Update, confirm the restart, and investigate further only when there is a real sign of exposure or compromise.

Signs worth taking seriously include a ransom note, files suddenly renamed or unreadable, security software disabled without explanation, an unknown remote-access tool, a new administrator account, or a business alert tied to the specific machine. High fan noise, one crash, or taskhostw.exe appearing in Task Manager does not establish an attack. Ordinary symptoms need ordinary troubleshooting until stronger evidence appears.

A person who finds a ransom note should stop treating the case as a patching exercise. Disconnect the affected computer from Wi-Fi and wired networks to reduce further spread, avoid plugging in backup drives, photograph the message, and contact the organisation’s IT provider or a trusted technician. A business should start its incident plan and preserve evidence. Paying, restoring, legal duties, and customer communication need informed decisions that a generic article cannot make for a particular case.

If no incident signs exist, running five different scanners rarely adds five times the certainty. Windows Security’s built-in scan is a reasonable check after updating if you are concerned. A second opinion from a reputable tool may help when a technician recommends it. Random utilities advertised beside a ransomware headline create their own risk because the reader is being asked to install unknown code with deep access.

Calm comes from matching the action to the evidence. The catalogue entry justifies making the update today. It does not justify wiping a healthy, current computer or changing every password in the family before dinner.

The ten-minute Windows check

Start with the computer itself, not a search result or a security advert. Save your work and make sure the laptop has power. The sequence below moves from the high-value update to the few checks that tell you whether your case needs more attention.

1. Open the real Windows Update page: Select Start, open Settings, and choose Windows Update. Avoid update buttons in browser pop-ups, emails, or web adverts. Microsoft’s update service is the trusted route for this fix.

2. Install the available security updates: Choose Check for updates if Windows is not already working. Allow offered quality and security updates to download and install. You do not need to search manually for CVE-2025-60710 when a supported Windows installation is receiving current cumulative updates.

3. Complete the restart: A downloaded patch may not protect the running system until Windows replaces files during a restart. Use the restart requested by Windows, then return to Windows Update. Repeat the check until it reports that you are up to date or clearly explains an optional item.

4. Look at update history if something seems stuck: On the Windows Update page, open Update history. Recent successful quality updates show that the update path is working. Repeated failures deserve attention from Microsoft Support, your computer maker, or the person who maintains the machine. Do not hide the symptom with a cleanup utility.

5. Check the Windows version only when it changes the answer: Under Settings, System, About, note the Windows edition and version. NVD currently names Windows 11 24H2 and 25H2 as affected client releases. Windows Server 2025 belongs with an administrator, not a home troubleshooting session.

6. Run the built-in security scan if you have a reason for concern: Open Windows Security, choose Virus and threat protection, check that protection is on, and run a scan. A current scan adds useful evidence after the operating system is patched. It does not certify that a machine with clear signs of takeover is clean.

7. Treat clear incident signs as a different job: If files are encrypted, a ransom message appears, security controls have been switched off, or an unknown administrator account exists, disconnect the computer from the network and get qualified help. Change important passwords from a separate, known-clean device after the response plan tells you which accounts may have been exposed.

This sequence deliberately leaves out taskhostw.exe hunting, registry changes, unofficial patches, and exploit tests. Those activities can damage a working computer or create a new infection while answering little. The safe repair arrived through Windows Update months ago.

A family with several computers can do the check one machine at a time. Start with the computer used for email, banking, family photos, or shared documents. Finish its update and restart before moving on. You do not need to turn a Tuesday evening into an inventory project for every old cable in the house.

If a relative needs help, sit with them or use a support route both of you already trust. Never hand control to somebody who calls because they supposedly detected this vulnerability. Microsoft, CISA, and your internet provider do not need gift cards or cryptocurrency to install a Windows security update.

A stronger plan for a small business

A small business needs the same patch plus proof that it reached every machine. The owner should not have to learn vulnerability-management vocabulary to ask the right question. Ask the IT provider for a list of affected Windows 11 and Windows Server 2025 systems, their latest successful cumulative update, and any machine that has not checked in.

That list should include laptops away from the office, spare computers, shared front-desk PCs, virtual machines, and server templates that could return later. A powered-off laptop is not safe merely because the dashboard last saw it three months ago. It carries the patch state from the day it went into the cupboard.

The second request concerns signs of first access. Because CVE-2025-60710 raises privileges locally, its use implies that an attacker had already reached the machine in some way. If monitoring detects exploitation or a suspicious SYSTEM-level change, the investigation should look backward for the initial account, program, attachment, remote connection, or exposed service. Closing only the privilege ladder can leave the original door open.

The third request concerns reach. Separate daily user accounts from administrator accounts. Remove local administrator rights where ordinary work does not need them. Limit shared folders so one reception computer cannot rewrite every department’s files. Require separate, protected administrator credentials for backups and management tools. These choices do not make exploitation impossible, but they reduce what one compromised machine can command.

Backups deserve a real restoration test. Ransomware operators often try to damage reachable backups because a working restore weakens their demand. Keep at least one copy that an everyday Windows account cannot delete or rewrite, and prove that somebody can restore a sample file and a whole business system. A green backup icon reports that a copy ran; a test reports that recovery works.

Endpoint security alerts need an owner. Buying a security service without deciding who reads its warnings creates a silent alarm. For a five-person company, the owner may be the outside IT provider. The agreement should say who receives urgent notices, how quickly they respond, and how the business reaches a human when the screen shows a ransom demand.

Do not ask the provider only, “Are we patched?” A more useful question is, “Which machines missed the current cumulative update, and what happens if one of them is taken over?” The first half finds the old software. The second reveals whether one stolen machine can reach payroll, backups, and every shared document.

The Digital Fortress covers this same household logic in more detail: close the door that matters, keep a recovery copy outside the burglar’s reach, and spend attention where it buys real safety. A small business does not need a bank’s security department. It does need updates that complete and backups that survive the account used every day.

The lesson that lasts after this CVE number fades

CVE-2025-60710 is useful because it shows two security failures in sequence. First, an attacker reaches a Windows account. Then a flaw in a trusted background process can help that attacker gain the computer’s master key. Ransomware is what makes the chain visible, but the architecture of the problem is older and broader than ransomware.

Patching breaks one link. Account separation, limited sharing, protected backups, and a clear response plan weaken the others. No single setting has to carry the whole defence. That is good news for people with finite time because several ordinary controls can each make a bad day smaller.

The warning also shows why update dates can mislead. A fix released in November 2025 still matters in August 2026 because some machines never completed it and criminals keep old tools that work. Installing the current cumulative update is simpler than memorising the history. Verify the result, then move on with your life.

As of 18 August 2026, public sources do not name the ransomware group or victims behind CISA’s new label. We know enough to patch, but not enough to decorate the story with dramatic claims. That boundary between known and unknown is part of good security advice.

So do the boring thing. Open Windows Update from Settings, install what is waiting, restart, and check once more. If the page is current and the computer shows no real sign of compromise, you have dealt with this warning in the way that matters.

For calm, practical security guidance without a daily alarm bell, join the newsletter on this site. It is one email per month.

Sources

• CISA: Known Exploited Vulnerabilities Catalog JSON, accessed 2026-08-18
• CISA: Known Exploited Vulnerabilities Catalog, accessed 2026-08-18
• CISA: Ransomware Vulnerability Warning Pilot updates, accessed 2026-08-18
• Microsoft Security Response Center: CVE-2025-60710, accessed 2026-08-18
• National Vulnerability Database: CVE-2025-60710, accessed 2026-08-18
• BleepingComputer: CISA says Windows Task Host flaw is now exploited by ransomware gangs, accessed 2026-08-18
• The Register: Ransomware crews and other criminals exploit four older Microsoft bugs, accessed 2026-08-18
• Microsoft Support: Windows Update FAQ, accessed 2026-08-18