Microsoft Windows Link Following Vulnerability

Who is affected

How to fix it

Treat CVE-2025-60710 as an actively exploited Microsoft Windows privilege escalation risk. The record identifies a link-following weakness, so the main remediation is to apply the Microsoft Security Update Guide fix through the correct Windows cumulative security update for each affected branch. Prioritize workstations and servers used by administrators, RDP users, service accounts, and systems with recent malware or suspicious local activity. If a device cannot be patched, isolate it or apply compensating controls until it can be retired or rebuilt.

1. Inventory Windows clients and servers, including administrator workstations, RDP hosts, jump boxes, domain controllers, and application servers.
2. Check each system against the Microsoft Security Update Guide entry for CVE-2025-60710 and its installed cumulative update level.
3. Deploy the applicable Windows cumulative security update through Windows Update, WSUS, Intune, SCCM, or the approved endpoint management workflow.
4. Prioritize devices with privileged users, remote access exposure, shared file paths, or recent endpoint security alerts.
5. Restrict local administrator rights, writable system paths, and untrusted shared directories while patching is in progress.
6. Review EDR and Windows event logs for suspicious symlink, junction, hard-link, service creation, scheduled task, or privilege escalation activity.
7. Rotate credentials and investigate lateral movement if exploitation or post-exploitation activity is suspected.
8. Retire or isolate unsupported Windows versions that cannot receive the Microsoft security update.

Verify the fix

• Confirm each Windows host shows the Microsoft cumulative update or later update that includes the CVE-2025-60710 fix.
• Confirm WSUS, Intune, SCCM, Defender for Endpoint, or vulnerability management data no longer flags CVE-2025-60710.
• Confirm no critical Windows security updates remain pending for the affected OS branch.
• Review post-patch endpoint logs for continued local privilege escalation attempts or suspicious link-following behavior.
• Run a Fixnx scan against public Windows-hosted services to understand external exposure after remediation.

Related categories

Trusted references

FAQ