CVE-2025-60710: Why Your RMM Isn't Catching Windows Task Host Flaws

CISA recently confirmed that ransomware gangs are actively exploiting CVE-2025-60710, a privilege-escalation vulnerability in the Windows Task Host. This flaw affects Windows 11 and Windows Server 2025. While Microsoft released a patch in November 2025, the reality for most IT operations teams is that a "Patch Released" email doesn't instantly equal "Patch Installed" across the fleet.

For internal IT departments and MSPs, this exposes a critical gap in the standard RMM model. You can have the best patch management policy in the world, but if you are waiting for a weekly compliance report to tell you a server missed an update, you are already exposed. In the time it takes for a server to reboot and finalize the update, a ransomware actor exploiting this Task Host flaw can escalate privileges and begin encryption.

The Problem: Tool Sprawl Creates Blind Spots

The issue isn't just the vulnerability; it's the operational blindness caused by relying on disconnected tools.

Most IT environments run a fragmented stack:

RMM (e.g., Datto, NinjaOne, ConnectWise): Handles the patching job. It queues the update, installs it, and checks a box saying "Compliant."
Separate Monitoring Tool: Watches CPU and RAM. It alerts if the server goes down, but it doesn't know if the Task Host service is behaving suspiciously.
Helpdesk: Waits for a user ticket.

The Gap: When the RMM queues a patch for CVE-2025-60710, the server requires a reboot. If a technician manually postpones the reboot, or if the service fails to start post-update, your RMM might still show the patch as "Installed" while the underlying service is unstable or the vulnerability remains active.

Meanwhile, your monitoring tool sees the server is "Up." It doesn't know that the TaskHost.exe process is spawning child processes at an abnormal rate—a potential sign of exploitation. You only find out about the issue when the Helpdesk gets a ticket from a user saying their files are encrypted.

This is the 40-minute response gap. The time between the initial system instability or exploit and the time a human intervenes is wasted time spent switching tabs between your RMM console and your monitoring dashboard.

How AlertMonitor Solves This

AlertMonitor eliminates this lag by unifying infrastructure monitoring, RMM data, and alerting into a single pane of glass. We don't just ping your server; we watch the services and processes that matter.

1. Contextual Alerting on Windows Services

Instead of a generic "High CPU" alert that gets ignored, AlertMonitor monitors the Windows Task Host service specifically. If this service crashes, restarts repeatedly, or spawns unexpected processes following a patch cycle, AlertMonitor triggers a critical alert immediately.

2. The Integrated Workflow

In a fragmented environment, an admin sees an alert in Tool A, logs into Tool B (RMM) to check patch status, and then logs into Tool C to remote in. With AlertMonitor:

The Alert: You receive a notification: *"Server-01: Windows Task Host service stopped unexpectedly (Post-Patch)."
The Context: Clicking the alert opens the unified dashboard where you can see the recent patch history alongside the service status in one view.
The Action: You can execute a remediation script or push the restart command immediately without changing tabs.

3. Faster Than the Ransomware

When CVE-2025-60710 is being exploited, speed is the only defense that matters. AlertMonitor intelligent alerting ensures the right sysadmin is paged within 90 seconds of a service failure, rather than discovering the breach 40 minutes later when a user reports locked files.

Practical Steps: Verify Your Defense

Don't rely on your RMM's dashboard alone. You need to actively query your Windows Server 2025 environments to ensure the patch for CVE-2025-60710 is active and the Task Host service is stable.

Use the following PowerShell script to audit your servers immediately. This script checks for the presence of the security update (placeholder KB used for example) and verifies the status of the Task Scheduler service, which relies on Task Host.

PowerShell

# Audit Script for CVE-2025-60710 Mitigation
# Checks for specific patch and Task Host service state

# Define the Patch ID associated with CVE-2025-60710
# Verify exact KB number from Microsoft Security Update Guide
$TargetPatch = "KB5048621" 

$ComputerName = $env:COMPUTERNAME
$ComplianceStatus = "COMPLIANT"
$Details = @()

# 1. Check Patch Installation
$Patch = Get-HotFix -Id $TargetPatch -ErrorAction SilentlyContinue

if (-not $Patch) {
    $ComplianceStatus = "VULNERABLE"
    $Details += "Missing Security Patch: $TargetPatch"
} else {
    $Details += "Patch $TargetPatch found (Installed: $($Patch.InstalledOn))"
}

# 2. Check Task Host / Task Scheduler Service Status
# Task Host is critical for executing scheduled tasks used by attackers for persistence
$Svc = Get-Service -Name "Schedule" -ErrorAction SilentlyContinue

if (-not $Svc) {
    $ComplianceStatus = "ERROR"
    $Details += "Task Scheduler service not found!"
} elseif ($Svc.Status -ne "Running") {
    $ComplianceStatus = "WARNING"
    $Details += "Task Scheduler service is $($Svc.Status). Exploits may fail silently or logging may be impaired."
} else {
    $Details += "Task Scheduler service is Running."
}

# 3. Output for AlertMonitor Custom Script Monitor
Write-Output "Host: $ComputerName | Status: $ComplianceStatus"
$Details | ForEach-Object { Write-Output "- $_" }

# Exit code for monitoring tool integration
if ($ComplianceStatus -eq "VULNERABLE") { exit 2 }
if ($ComplianceStatus -eq "WARNING") { exit 1 }
exit 0

Implementation in AlertMonitor

Create a Script Monitor: Import this script into AlertMonitor as a custom script check for your Windows Server 2025 group.
Set Alert Logic: Configure AlertMonitor to trigger a Critical page if the script exits with code 2 (Patch Missing).
Automate Remediation: If the status returns "WARNING" (Service not running), configure an AlertMonitor automation task to attempt a service restart before escalating to a technician.

Conclusion

CVE-2025-60710 is a reminder that infrastructure monitoring must go deeper than "is the server on?" It must answer "is the server secure and stable?" By consolidating your monitoring, patch management, and alerting, AlertMonitor closes the window of opportunity that ransomware gangs rely on.

Related Resources

AlertMonitor Infrastructure & Server Monitoring AlertMonitor Platform Overview Book a Demo Infrastructure & Server Monitoring Resources