Yes. CISA added CVE-2025-60710 to its Known Exploited Vulnerabilities catalogue on 13 April 2026, which it does only when there is reliable evidence of active exploitation. CISA lists it as known to be used in ransomware campaigns. Microsoft Windows contains a link following vulnerability that allows for privilege escalation Any organisation running the affected product should treat remediation as urgent.
What CISA’s KEV listing tells you about this Windows flaw
CISA’s KEV inclusion is the practical signal that matters first: this is not just a theoretical weakness, it is already being used in real attacks. For defenders, the immediate question is whether any Windows systems in scope can still be reached by the vulnerable link-following behavior that lets an attacker raise privileges after user interaction or local execution.
Because the issue is in Microsoft Windows rather than a single third-party app, exposure assessment should be broad. Confirm which endpoints, servers, virtual desktops, and shared Windows images are in the estate, then compare them against the vendor advisory and the CISA KEV entry so you know exactly which platforms and remediation steps apply.
That triage is where a vulnerability management process becomes operationally useful. The objective is not only to find the CVE in a scanner result, but to identify where the same weakness may exist across base images, gold builds, stale devices, and systems that are hard to patch quickly. The Vulnerability Management Guide is the right internal reference for turning that exposure check into prioritised remediation.
Why link-following bugs are dangerous in Windows environments
A link-following flaw is especially risky because Windows shortcut, junction, or symbolic-link handling can be abused to redirect trusted operations to a different target than the defender expects. When that behavior is tied to privilege escalation, the attacker is no longer relying on malware alone, they are abusing a trust boundary in the operating system itself.
In practical terms, that means a low-privileged foothold can become a higher-value one if the vulnerable path is reachable during normal system activity, file handling, or maintenance workflows. Attackers prefer these flaws because they can blend into legitimate administration, which makes detection harder than with obvious exploit payloads. The CISA Known Exploited Vulnerabilities Catalog is useful here because it distinguishes exploitation evidence from mere theoretical exposure.
For teams that want to understand the broader pattern of abuse, Microsoft Windows link-following problems sit in the same family of weakness as other path-equivalence and link-handling issues. The CWE Top 25 Guide helps place that class of weakness in context, especially when you are mapping recurring implementation defects rather than one-off product bugs.
How to respond when patching is delayed
If remediation cannot happen immediately, reduce the chance that the vulnerable behavior can be reached. That usually means tightening who can log on interactively, limiting local admin rights, hardening privileged workflows, and watching for unexpected file or link creation in locations used by software installation, update, or support tooling. The more ordinary the trigger path looks, the more important it is to constrain who can reach it.
When delay is unavoidable, the priority is to lower blast radius and raise visibility. Restrict the systems that can perform privileged maintenance, keep vulnerable hosts off high-trust administrative paths where possible, and look for unusual privilege changes, new scheduled tasks, or suspicious child processes after file operations. If you cannot patch, you need compensating controls that make exploitation noisy and short-lived rather than silent and persistent.
For a response path built around active exploitation, the fastest decision point is simple: if the host is exposed and business critical, treat it as an urgent remediation item rather than a routine backlog task. The external reference points that matter most are the CVE Program for record identity and the vendor advisory for authoritative remediation detail.
Risk and Threat Considerations
This CVE sits in a high-risk class because privilege escalation vulnerabilities are attractive both for initial compromise chains and for post-compromise expansion. If exploitation is already happening in the wild, the main concern is not just the first foothold, but the speed with which an attacker can turn that foothold into broader local control on the same Windows estate.
Failure mechanism: An attacker or malicious local actor reaches the vulnerable link-following path, causes the system to resolve an unintended target, and uses that behavior to obtain privileges beyond what should have been available.
Impact: Successful exploitation can enable deeper system control, accelerate lateral movement, and create a faster path to ransomware deployment or other high-impact actions.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while CIS Controls v8, NIST CSF 2.0 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| CIS Controls v8 | CIS-7 — Continuous Vulnerability Management | Active exploitation makes rapid identification and remediation central. |
| Recommendation — Prioritise, remediate, and track this KEV-listed Windows vulnerability in your vulnerability management workflow. | ||
| NIST CSF 2.0 | GV.RM-01 — Risk Management Strategy | KEV exploitation requires risk-based prioritisation and escalation. |
| Recommendation — Escalate this CVE using your risk management criteria and treat confirmed exploitation as urgent. | ||
| NIST SP 800-53 Rev 5 | SI-2 — Flaw Remediation | The issue requires timely remediation of an actively exploited software flaw. |
| AC-6 — Least Privilege | Reducing excessive local privilege limits the impact of a successful escalation path. | |
| Recommendation — Patch or mitigate the flaw promptly and document compensating actions until remediation is complete. Constrain local administrative rights to reduce the blast radius of privilege escalation. | ||
| MITRE ATT&CK | T1068 — Exploitation for Privilege Escalation | The vulnerability allows an attacker to gain higher privileges after exploitation. |
| Recommendation — Map detections and hunt queries to privilege-escalation activity on affected Windows hosts. | ||
Practitioner Guidance
What to prioritise: Put any internet-facing, user-facing, or operationally critical Windows system first, then move to shared images and long-lived hosts that are easy to forget. Those systems are most likely to be exploited before routine maintenance catches them.
What to verify: Confirm patch state, but also verify whether local privilege boundaries are actually meaningful on the host. A patched asset with excessive local admin exposure, weak monitoring, or old admin tooling can still leave the organisation with a poor security outcome.
Escalation / exception: If patching must wait, escalate it as an active exposure problem, not a standard exception. The deciding factor is whether the host can be reached by an attacker path that turns low privilege into higher privilege.
Practitioner takeaway: For KEV-listed Windows privilege-escalation flaws, urgency should be driven by exploit evidence and blast radius, not by whether the vulnerability looks narrow in isolation.
Related resources from NHI Mgmt Group
- Guide: Zero-Day and Exploited Vulnerabilities Guide
- CVE-2025-60710 (Microsoft Windows Link Following)
- CVE-2025-21391 (Microsoft Windows Storage Link Following)
- Is CVE-2023-32049 (Microsoft Windows Defender SmartScreen Security Feature Bypass) being exploited in the wild?
- Is CVE-2014-1812 (Microsoft Windows Group Policy Preferences Password Privilege Escalation) being exploited in the wild?