How do you patch or mitigate CVE-2025-60710 (Microsoft Windows Link Following)?

By NHI Mgmt Group Editorial Team Updated October 19, 2026 Domain: Threats, Abuse & Incident Response

CISA's required action for CVE-2025-60710 is to apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. In practice, find every instance of Microsoft Windows in your estate, apply the vendor security update or documented mitigation, and if no fix can be applied, remove internet exposure or take the product out of service.

What this CVE means operationally

CVE-2025-60710 should be handled as an exploited vulnerability response, not a routine patch task. The practical question is whether any Microsoft Windows instance in your estate is still exposed, whether the vendor update or documented mitigation has been applied, and whether the system can be safely removed from internet reach if remediation has to wait.

Because the required action is mitigation or discontinuation when mitigation is unavailable, the first decision is exposure control. If the affected Windows system serves users or services from a public or broadly reachable path, treat that reachability as part of the risk, not as an implementation detail. A temporary containment step can be more valuable than waiting for a perfect change window.

For broader exploit-response playbooks, the Zero-Day and Exploited Vulnerabilities Guide is the best match for emergency triage, mitigation-first response, and post-patch verification, while the Vulnerability Management Guide covers asset scope, prioritisation, exceptions, and remediation tracking for vulnerabilities that need immediate attention.

How to verify exposure before you change anything

Start by locating every Microsoft Windows instance that could plausibly be affected, including endpoints, servers, virtual machines, and cloud-hosted systems. Confirmation matters because you need to know not only where Windows exists, but which systems are actually reachable in the way the vulnerability can be exercised.

Then verify the vendor guidance for the exact mitigation path that applies to your build and deployment model. The key operational check is whether the fix is a security update, a configuration change, a service restriction, or a compensating control that reduces exposure without altering the software itself.

If you are working across large fleets, use a repeatable inventory and verification method rather than ad hoc review. That is especially important when the same product is deployed in multiple business units or in both managed and unmanaged environments, where one exposed instance can remain overlooked long after the main rollout appears complete.

What to do when patching must wait

If you cannot apply the vendor update immediately, reduce the attack surface first. That usually means removing internet exposure, limiting inbound access to trusted sources only, or taking the product out of service if no safe mitigation exists. The goal is to break the reachable path rather than rely on the hope that exploitation will not occur before maintenance is possible.

Where a mitigation is available, apply it exactly as documented and confirm that the vulnerable service or feature is no longer exposed. In a live estate, a mitigation is only useful if it is actually enforced at the boundary that matters, such as network access, service configuration, or product-specific hardening.

If your environment depends on cloud-hosted Windows services or related managed exposure points, follow the applicable BOD 22-01 guidance referenced in the action statement and keep the change scoped to the minimum that removes exposure while preserving necessary business function.

Risk and Threat Considerations

This vulnerability matters because exploited Windows flaws are often used to gain an initial foothold, expand access, or establish persistence before defenders have a chance to patch. The practical risk is not just the flaw itself, but the window of exposure between publication, detection, and full remediation.

Failure mechanism: An attacker can target an exposed Windows instance before the update or mitigation is in place, then use that access to move from opportunistic compromise into broader internal access if the system remains reachable.

Impact: Exposure can lead to unauthorized execution, lateral movement, service disruption, or the need for broader incident response if there are signs the system was already accessed before remediation.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

OWASP Non-Human Identity Top 10 addresses the attack and risk surface, while CIS Controls v8, NIST CSF 2.0 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.

Framework	Control / Reference	Relevance
CIS Controls v8	CIS-7 — Continuous Vulnerability Management	Windows patching and mitigation are core vulnerability management tasks.
Recommendation — Track exposed Windows assets, prioritize remediation, and verify closure of the vulnerability.
NIST CSF 2.0	ID.RA-01 — Asset Vulnerabilities Are Identified and Documented	The answer depends on identifying exposed Windows instances before mitigation.
	PR.PS-02 — Software, Firmware, and Information Are Patched or Updated	Applying the vendor security update is the primary remediation action here.
	PR.AA-05 — Physical and Logical Access Permissions Are Managed	Removing internet exposure and limiting access are direct compensating controls when patching waits.
Recommendation — Identify affected Windows assets and document where the vulnerability remains exposed. Apply the vendor update or documented mitigation to remove the vulnerability. Restrict reachability to the minimum necessary until remediation is complete.
NIST SP 800-53 Rev 5	RA-5 — Vulnerability Monitoring and Scanning	Confirming every Windows instance and verifying exposure are classic vulnerability monitoring activities.
	SI-2 — Flaw Remediation	The action required is to remediate the flaw through vendor instructions or compensating controls.
	AC-4 — Information Flow Enforcement	Internet exposure reduction is an information-flow control used when patching cannot wait.
Recommendation — Scan for exposed Windows systems and confirm remediation status after mitigation. Apply the vendor fix or approved mitigation and document any exception. Limit inbound and outbound paths so the vulnerable service is not broadly reachable.
OWASP Non-Human Identity Top 10	NHI-08 — Environment Isolation	If Windows services are isolated from internet exposure, the attack surface is reduced during remediation.
Recommendation — Segregate the affected service from public access until the fix is complete.

Practitioner Guidance

What to prioritise: Prioritise externally reachable Windows systems first, then high-value internal systems that have broad trust relationships. Exposure and reachability matter more than convenient patch order when exploitation is already public or likely.

What to verify: Verify that the mitigation actually changes the reachable attack path, not just the configuration state on paper. After change, confirm service availability, external exposure, and any compensating control you relied on.

Decision rule: If you can neither patch nor mitigate quickly, remove the product from service or from internet reach until remediation is complete. Do not leave a known exploitable path open while waiting for a maintenance window.

Practitioner takeaway: For an actively relevant Windows CVE, the right response is exposure reduction first, fix second, and proof of closure last, because the gap between knowing about the flaw and actually removing reachability is where most avoidable risk sits.

Deepen Your Knowledge

Free weekly newsletter

Subscribe to the NHI & AI Identity Journal

The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.

Bonus 33% off our NHI Course when you subscribe.

NHIMG Editorial Note
Reviewed and updated by the NHIMG editorial team on October 19, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org