{"metadata": {"vulnerability": "CVE-2025-60710", "count": 105, "kinds": {"milestone": 9, "sighting": 54, "kev": 11, "other": 31}, "linked_omitted": 0}, "data": [{"timestamp": "2025-08-04T16:30:00Z", "date_only": false, "value": "2025-08-04T16:30:00Z", "kind": "other", "label": "Document generated", "source": "csaf_ncscnl \u00b7 NCSC-2025-0358", "record": "NCSC-2025-0358", "field": "document.tracking.generator.date", "linked_record": true}, {"timestamp": "2025-09-26T05:03:24.536Z", "date_only": false, "value": "2025-09-26T05:03:24.536Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2025-60710", "field": "cveMetadata.dateReserved"}, {"timestamp": "2025-11-07T00:00:00Z", "date_only": false, "value": "2025-11-07T00:00:00+00:00", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2025-60710", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2025-11-07T00:00:00Z", "date_only": false, "value": "2025-11-07T00:00:00+00:00", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2025-60710", "record": "FKIE_CVE-2025-60710", "field": "metrics.ssvcV203.0.ssvcData.timestamp", "linked_record": true}, {"timestamp": "2025-11-11T00:00:00Z", "date_only": true, "value": "2025-11-11", "kind": "milestone", "label": "Published", "source": "certfr_avis \u00b7 CERTFR-2025-AVI-0996", "record": "CERTFR-2025-AVI-0996", "field": "vendor_advisories.0.published_at", "linked_record": true}, {"timestamp": "2025-11-11T08:00:00Z", "date_only": false, "value": "2025-11-11T08:00:00.000Z", "kind": "other", "label": "Advisory revision", "source": "csaf_microsoft \u00b7 MSRC_CVE-2025-60710", "record": "MSRC_CVE-2025-60710", "field": "document.tracking.revision_history.0.date", "linked_record": true}, {"timestamp": "2025-11-11T08:00:00Z", "date_only": false, "value": "2025-11-11T08:00:00.000Z", "kind": "milestone", "label": "Published", "source": "csaf_microsoft \u00b7 MSRC_CVE-2025-60710", "record": "MSRC_CVE-2025-60710", "field": "document.tracking.initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2025-11-11T08:00:00Z", "date_only": false, "value": "2025-11-11T08:00:00.000Z", "kind": "other", "label": "Vendor fix", "source": "csaf_microsoft \u00b7 MSRC_CVE-2025-60710", "record": "MSRC_CVE-2025-60710", "field": "vulnerabilities.0.remediations.0.date", "metric_role": "patch", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2025-11-11T16:00:00Z", "date_only": false, "value": "2025-11-11T16:00:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / microsoft", "record": "CVE-2025-60710", "field": "containers.cna.datePublic", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2025-11-11T17:29:38Z", "date_only": false, "value": "2025-11-11T17:29:38.000000Z", "kind": "sighting", "label": "Seen", "source": "https://advisories.ncsc.nl/advisory?id=NCSC-2025-0358", "record": "CVE-2025-60710", "field": "creation_timestamp", "uuid": "f1e28446-4e74-4c98-9bbe-fc3083a9c0a3", "url": "https://advisories.ncsc.nl/advisory?id=NCSC-2025-0358"}, {"timestamp": "2025-11-11T17:30:42Z", "date_only": false, "value": "2025-11-11T17:30:42.000000Z", "kind": "sighting", "label": "Seen", "source": "https://www.thezdi.com/blog/2025/11/11/the-november-2025-security-update-review", "record": "CVE-2025-60710", "field": "creation_timestamp", "uuid": "d908eaf5-46d2-4652-baa3-5fe6e48c7b6d", "url": "https://www.thezdi.com/blog/2025/11/11/the-november-2025-security-update-review"}, {"timestamp": "2025-11-11T17:59:25.479Z", "date_only": false, "value": "2025-11-11T17:59:25.479Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2025-60710", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2025-11-11T18:15:39Z", "date_only": false, "value": "2025-11-11T18:15:39Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-WMGF-G9PC-MVH3", "record": "GHSA-WMGF-G9PC-MVH3", "field": "database_specific.nvd_published_at", "linked_record": true}, {"timestamp": "2025-11-11T18:15:39.073Z", "date_only": false, "value": "2025-11-11T18:15:39.073", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2025-60710", "record": "FKIE_CVE-2025-60710", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2025-11-11T18:29:38.918Z", "date_only": false, "value": "2025-11-11T18:29:38.918562Z", "kind": "other", "label": "Advisory revision", "source": "csaf_ncscnl \u00b7 NCSC-2025-0358", "record": "NCSC-2025-0358", "field": "document.tracking.revision_history.0.date", "linked_record": true}, {"timestamp": "2025-11-11T18:29:38.918Z", "date_only": false, "value": "2025-11-11T18:29:38.918562Z", "kind": "milestone", "label": "Published", "source": "csaf_ncscnl \u00b7 NCSC-2025-0358", "record": "NCSC-2025-0358", "field": "document.tracking.initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2025-11-11T18:29:38.918Z", "date_only": false, "value": "2025-11-11T18:29:38.918562Z", "kind": "other", "label": "Updated", "source": "csaf_ncscnl \u00b7 NCSC-2025-0358", "record": "NCSC-2025-0358", "field": "document.tracking.current_release_date", "linked_record": true}, {"timestamp": "2025-11-11T18:30:21Z", "date_only": false, "value": "2025-11-11T18:30:21Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-WMGF-G9PC-MVH3", "record": "GHSA-WMGF-G9PC-MVH3", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2025-11-11T23:00:00Z", "date_only": false, "value": "2025-11-11T23:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2025-2564", "record": "WID-SEC-W-2025-2564", "field": "document.tracking.revision_history.0.date", "linked_record": true}, {"timestamp": "2025-11-11T23:00:00Z", "date_only": false, "value": "2025-11-11T23:00:00.000+00:00", "kind": "milestone", "label": "Published", "source": "csaf_certbund \u00b7 WID-SEC-W-2025-2564", "record": "WID-SEC-W-2025-2564", "field": "document.tracking.initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2025-11-11T23:00:00Z", "date_only": false, "value": "2025-11-11T23:00:00.000+00:00", "kind": "other", "label": "Release date", "source": "csaf_certbund \u00b7 WID-SEC-W-2025-2564", "record": "WID-SEC-W-2025-2564", "field": "vulnerabilities.18.release_date", "linked_record": true, "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2025-11-12T00:00:00Z", "date_only": false, "value": "2025-11-12T00:00:00", "kind": "other", "label": "Last revision date", "source": "certfr_avis \u00b7 CERTFR-2025-AVI-0996", "record": "CERTFR-2025-AVI-0996", "field": "last_revision_date", "linked_record": true}, {"timestamp": "2025-11-12T00:00:00Z", "date_only": false, "value": "2025-11-12T00:00:00", "kind": "milestone", "label": "Published", "source": "certfr_avis \u00b7 CERTFR-2025-AVI-0996", "record": "CERTFR-2025-AVI-0996", "field": "initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2025-11-12T00:00:00Z", "date_only": false, "value": "2025-11-12T00:00:00.000000", "kind": "other", "label": "Revision date", "source": "certfr_avis \u00b7 CERTFR-2025-AVI-0996", "record": "CERTFR-2025-AVI-0996", "field": "revisions.0.revision_date", "linked_record": true}, {"timestamp": "2025-11-12T09:10:47Z", "date_only": false, "value": "2025-11-12T09:10:47.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/P0x3k_1N73LL1G3NC3/196", "record": "CVE-2025-60710", "field": "creation_timestamp", "uuid": "9996f3d7-97b0-4de2-b4d5-fc77a168e861", "content": "CVE-2025-60710 Local Privilege Escalation in Taskhost Windows Tasks\n\nThis is PoC for local privilege escalation vulnerability in \\Microsoft\\Windows\\WindowsAI\\Recall\\PolicyConfiguration scheduled task.\nWhen this scheduled task is started the taskhostw.exe process whill try to open the C:\\Users\\%username%\\AppData\\Local\\CoreAIPlatform.00\\UKP directory and search for directories using the following filter: {????????-????-????-????-????????????}. If that directory is found it will be deleted without checking for symbolic links.\nAs low privilege user by default can create directories in their own %LOCALAPPDATA% folder this leads to arbitrary folder delete in context of NT AUTHORITY\\SYSTEM user.", "url": "https://t.me/P0x3k_1N73LL1G3NC3/196", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2025-11-12T11:37:48Z", "date_only": false, "value": "2025-11-12T11:37:48.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/L8IRYWQlLINCFGkrQPB4Yc80o1YA-P_zXNdVEzBYDf77AQ", "record": "CVE-2025-60710", "field": "creation_timestamp", "uuid": "6e738f0f-f0da-4a61-954d-c17c2cbc10a4", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2025-11-12T11:37:49Z", "date_only": false, "value": "2025-11-12T11:37:49.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/IOd4iGy4WmeEw_BHRHCcIohzvTPU8ysgCkcOW7mJ9lPu0g", "record": "CVE-2025-60710", "field": "creation_timestamp", "uuid": "b344adea-8913-4fc1-9efc-8e8026d811de", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2025-11-13T11:03:40.017Z", "date_only": false, "value": "2025-11-13T11:03:40.017873Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/dragonjar/statuses/115542053257805273", "record": "CVE-2025-60710", "field": "creation_timestamp", "uuid": "d99677bb-668d-4608-92ff-958f7c9e7677", "url": "https://infosec.exchange/users/dragonjar/statuses/115542053257805273"}, {"timestamp": "2025-11-13T23:00:00Z", "date_only": false, "value": "2025-11-13T23:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2025-2564", "record": "WID-SEC-W-2025-2564", "field": "document.tracking.revision_history.1.date", "linked_record": true}, {"timestamp": "2025-12-09T08:00:00Z", "date_only": false, "value": "2025-12-09T08:00:00.000Z", "kind": "other", "label": "Advisory revision", "source": "csaf_microsoft \u00b7 MSRC_CVE-2025-60710", "record": "MSRC_CVE-2025-60710", "field": "document.tracking.revision_history.1.date", "linked_record": true}, {"timestamp": "2025-12-11T08:00:00Z", "date_only": false, "value": "2025-12-11T08:00:00.000Z", "kind": "other", "label": "Advisory revision", "source": "csaf_microsoft \u00b7 MSRC_CVE-2025-60710", "record": "MSRC_CVE-2025-60710", "field": "document.tracking.revision_history.2.date", "linked_record": true}, {"timestamp": "2025-12-16T17:21:13.750Z", "date_only": false, "value": "2025-12-16T17:21:13.750Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CVE", "record": "CVE-2025-60710", "field": "containers.adp.1.providerMetadata.dateUpdated"}, {"timestamp": "2025-12-22T23:00:00Z", "date_only": false, "value": "2025-12-22T23:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2025-2564", "record": "WID-SEC-W-2025-2564", "field": "document.tracking.revision_history.2.date", "linked_record": true}, {"timestamp": "2026-01-02T08:00:00Z", "date_only": false, "value": "2026-01-02T08:00:00.000Z", "kind": "other", "label": "Advisory revision", "source": "csaf_microsoft \u00b7 MSRC_CVE-2025-60710", "record": "MSRC_CVE-2025-60710", "field": "document.tracking.revision_history.3.date", "linked_record": true}, {"timestamp": "2026-01-02T08:00:00Z", "date_only": false, "value": "2026-01-02T08:00:00.000Z", "kind": "other", "label": "Updated", "source": "csaf_microsoft \u00b7 MSRC_CVE-2025-60710", "record": "MSRC_CVE-2025-60710", "field": "document.tracking.current_release_date", "linked_record": true}, {"timestamp": "2026-01-02T19:48:27.021Z", "date_only": false, "value": "2026-01-02T19:48:27.021Z", "kind": "other", "label": "Document generated", "source": "csaf_microsoft \u00b7 MSRC_CVE-2025-60710", "record": "MSRC_CVE-2025-60710", "field": "document.tracking.generator.date", "linked_record": true}, {"timestamp": "2026-02-13T20:46:20.562Z", "date_only": false, "value": "2026-02-13T20:46:20.562Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / microsoft", "record": "CVE-2025-60710", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-04-13T00:00:00Z", "date_only": false, "value": "2026-04-13T00:00:00+00:00", "kind": "kev", "label": "Asserted", "source": "cisa-kev", "record": "CVE-2025-60710", "field": "timestamps.asserted_at", "metric_role": "exploitation_report", "metric_basis": "kev_report", "uuid": "102895ab-d4c1-4ccf-b753-c566efcf9709", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-04-13T00:00:00Z", "date_only": true, "value": "2026-04-13", "kind": "other", "label": "Catalog added", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2025-60710", "field": "containers.adp.0.metrics.1.other.content.dateAdded"}, {"timestamp": "2026-04-13T00:00:00Z", "date_only": true, "value": "2026-04-13", "kind": "kev", "label": "Date added", "source": "cisa-kev", "record": "CVE-2025-60710", "field": "evidence.0.details.date_added", "uuid": "102895ab-d4c1-4ccf-b753-c566efcf9709", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-04-13T00:00:00Z", "date_only": false, "value": "2026-04-13T00:00:00+00:00", "kind": "kev", "label": "First seen", "source": "cisa-kev", "record": "CVE-2025-60710", "field": "timestamps.first_seen_at", "metric_role": "exploitation_report", "metric_basis": "kev_report", "uuid": "102895ab-d4c1-4ccf-b753-c566efcf9709", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-04-13T00:00:00Z", "date_only": false, "value": "2026-04-13T00:00:00+00:00", "kind": "kev", "label": "Status updated", "source": "cisa-kev", "record": "CVE-2025-60710", "field": "status.status_updated_at", "uuid": "102895ab-d4c1-4ccf-b753-c566efcf9709", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-04-13T00:00:00Z", "date_only": false, "value": "2026-04-13T00:00:00.000Z", "kind": "other", "label": "Timeline", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2025-60710", "field": "containers.adp.0.timeline.0.time", "text": "CVE-2025-60710 added to CISA KEV"}, {"timestamp": "2026-04-13T18:00:02.914Z", "date_only": false, "value": "2026-04-13T18:00:02.914908Z", "kind": "sighting", "label": "Exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/102895ab-d4c1-4ccf-b753-c566efcf9709", "record": "CVE-2025-60710", "field": "creation_timestamp", "uuid": "59030382-5f7a-4619-81e2-87dd70db428a", "url": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/102895ab-d4c1-4ccf-b753-c566efcf9709", "metric_role": "exploitation", "metric_basis": "sighting_report"}, {"timestamp": "2026-04-13T18:07:36.314Z", "date_only": false, "value": "2026-04-13T18:07:36.314975Z", "kind": "sighting", "label": "Seen", "source": "https://feedsin.space/feed/CISAKevBot/items/6244768", "record": "CVE-2025-60710", "field": "creation_timestamp", "uuid": "d26d610c-2b52-4af1-b60f-5b64c0002230", "url": "https://feedsin.space/feed/CISAKevBot/items/6244768"}, {"timestamp": "2026-04-13T18:30:34Z", "date_only": false, "value": "2026-04-13T18:30:34Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-WMGF-G9PC-MVH3", "record": "GHSA-WMGF-G9PC-MVH3", "field": "modified", "linked_record": true}, {"timestamp": "2026-04-13T19:27:37.564Z", "date_only": false, "value": "2026-04-13T19:27:37.564227Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/AAKL/statuses/116399043810586963", "record": "CVE-2025-60710", "field": "creation_timestamp", "uuid": "d1dd4f67-ec27-4b0a-af26-8375483c67d9", "url": "https://infosec.exchange/users/AAKL/statuses/116399043810586963"}, {"timestamp": "2026-04-13T20:01:32.480Z", "date_only": false, "value": "2026-04-13T20:01:32.480215Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/pigondrugs.bsky.social/post/3mjfnti6xlz25", "record": "CVE-2025-60710", "field": "creation_timestamp", "uuid": "c6dec834-6f66-4610-933f-0f9b41ebd4c8", "url": "https://bsky.app/profile/pigondrugs.bsky.social/post/3mjfnti6xlz25"}, {"timestamp": "2026-04-13T21:22:02Z", "date_only": false, "value": "2026-04-13T21:22:02.000000Z", "kind": "sighting", "label": "Seen", "source": "Telegram/LHQfgYAbtuG7CogYZyWoKm7-py5GuHojGsIqn2GfOFcZFnQ", "record": "CVE-2025-60710", "field": "creation_timestamp", "uuid": "67b8b02e-a64d-4a98-8fdb-ed1c7f30e827"}, {"timestamp": "2026-04-13T22:00:00Z", "date_only": false, "value": "2026-04-13T22:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2025-2564", "record": "WID-SEC-W-2025-2564", "field": "document.tracking.revision_history.3.date", "linked_record": true}, {"timestamp": "2026-04-13T22:00:00Z", "date_only": false, "value": "2026-04-13T22:00:00.000+00:00", "kind": "other", "label": "Updated", "source": "csaf_certbund \u00b7 WID-SEC-W-2025-2564", "record": "WID-SEC-W-2025-2564", "field": "document.tracking.current_release_date", "linked_record": true}, {"timestamp": "2026-04-14T09:05:44.156Z", "date_only": false, "value": "2026-04-14T09:05:44.156+00:00", "kind": "other", "label": "Document generated", "source": "csaf_certbund \u00b7 WID-SEC-W-2025-2564", "record": "WID-SEC-W-2025-2564", "field": "document.tracking.generator.date", "linked_record": true}, {"timestamp": "2026-04-14T14:13:46Z", "date_only": false, "value": "2026-04-14T14:13:46.000000Z", "kind": "sighting", "label": "Seen", "source": "https://gist.github.com/stone776/3d08ecfe13c93ecafaa4d45bb1ff7634", "record": "CVE-2025-60710", "field": "creation_timestamp", "uuid": "bbcc48bb-f32c-4bd4-bc6e-73a1fb3fb9ac", "url": "https://gist.github.com/stone776/3d08ecfe13c93ecafaa4d45bb1ff7634"}, {"timestamp": "2026-04-14T21:03:07.021Z", "date_only": false, "value": "2026-04-14T21:03:07.021608Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/beikokucyber.bsky.social/post/3mjibqcs5kg2h", "record": "CVE-2025-60710", "field": "creation_timestamp", "uuid": "da23f28e-0154-4b1a-bbff-792f2d822aad", "url": "https://bsky.app/profile/beikokucyber.bsky.social/post/3mjibqcs5kg2h"}, {"timestamp": "2026-04-15T16:15:22.585Z", "date_only": false, "value": "2026-04-15T16:15:22.585061Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/hendryadrian.bsky.social/post/3mjkc4w5lcw2h", "record": "CVE-2025-60710", "field": "creation_timestamp", "uuid": "c9e88b5c-f861-48ef-b178-c4feb4906b10", "url": "https://bsky.app/profile/hendryadrian.bsky.social/post/3mjkc4w5lcw2h"}, {"timestamp": "2026-04-27T00:00:00Z", "date_only": true, "value": "2026-04-27", "kind": "kev", "label": "Due date", "source": "cisa-kev", "record": "CVE-2025-60710", "field": "evidence.0.details.due_date", "uuid": "102895ab-d4c1-4ccf-b753-c566efcf9709", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-06-01T13:07:10Z", "date_only": false, "value": "2026-06-01T13:07:10+00:00", "kind": "kev", "label": "Asserted", "source": "kevintel", "record": "CVE-2025-60710", "field": "timestamps.asserted_at", "metric_role": "exploitation_report", "metric_basis": "kev_report", "batch_listing": true, "uuid": "44f52d28-ae29-4bb6-99b4-e619c1d8e62b", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-06-01T13:07:10Z", "date_only": false, "value": "2026-06-01T13:07:10+00:00", "kind": "kev", "label": "First seen", "source": "kevintel", "record": "CVE-2025-60710", "field": "timestamps.first_seen_at", "metric_role": "exploitation_report", "metric_basis": "kev_report", "batch_listing": true, "uuid": "44f52d28-ae29-4bb6-99b4-e619c1d8e62b", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-06-01T13:07:10Z", "date_only": false, "value": "2026-06-01T13:07:10+00:00", "kind": "kev", "label": "Status updated", "source": "kevintel", "record": "CVE-2025-60710", "field": "status.status_updated_at", "uuid": "44f52d28-ae29-4bb6-99b4-e619c1d8e62b", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-06-01T13:07:10.908Z", "date_only": false, "value": "2026-06-01T13:07:10.908Z", "kind": "kev", "label": "Catalog added", "source": "kevintel", "record": "CVE-2025-60710", "field": "evidence.0.details.added_date", "uuid": "44f52d28-ae29-4bb6-99b4-e619c1d8e62b", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-06-19T12:45:13.655Z", "date_only": false, "value": "2026-06-19T12:45:13.655839Z", "kind": "sighting", "label": "Exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/54b507a8-84b0-4364-9927-43c5519882f0", "record": "CVE-2025-60710", "field": "creation_timestamp", "uuid": "9e172db2-c715-4453-9f16-c1b590d08727", "url": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/54b507a8-84b0-4364-9927-43c5519882f0", "metric_role": "exploitation", "metric_basis": "sighting_report"}, {"timestamp": "2026-06-23T14:02:37Z", "date_only": false, "value": "2026-06-23T14:02:37+00:00", "kind": "kev", "label": "Recorded", "source": "kevintel", "record": "CVE-2025-60710", "field": "timestamps.recorded_at", "metric_role": "exploitation_report", "metric_basis": "kev_report", "batch_listing": true, "uuid": "44f52d28-ae29-4bb6-99b4-e619c1d8e62b", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-06-23T14:03:40.140Z", "date_only": false, "value": "2026-06-23T14:03:40.140291Z", "kind": "sighting", "label": "Exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/44f52d28-ae29-4bb6-99b4-e619c1d8e62b", "record": "CVE-2025-60710", "field": "creation_timestamp", "uuid": "693325c4-45d3-41a7-aacb-89b08dcf70ad", "url": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/44f52d28-ae29-4bb6-99b4-e619c1d8e62b", "metric_role": "exploitation", "metric_basis": "sighting_report"}, {"timestamp": "2026-07-20T19:00:09.410Z", "date_only": false, "value": "2026-07-20T19:00:09.410700Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/proxy_bar/2871", "record": "CVE-2025-60710", "field": "creation_timestamp", "uuid": "dc7cbcbf-6f8e-43e8-95de-a4d8cdf20e90", "content": "CVE-2025-60710\n*\nLPE \u0432 \\Microsoft\\Windows\\WindowsAI\\Recall\\PolicyConfiguration scheduled task.\n*\nPOC\n\n\n#win #lpe", "url": "https://t.me/proxy_bar/2871"}, {"timestamp": "2026-07-22T00:00:25.961Z", "date_only": false, "value": "2026-07-22T00:00:25.961152Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/proxy_bar/2871", "record": "CVE-2025-60710", "field": "creation_timestamp", "uuid": "773513d3-092b-4ae1-a6be-daea5e2be399", "content": "CVE-2025-60710\n*\nLPE \u0432 \\Microsoft\\Windows\\WindowsAI\\Recall\\PolicyConfiguration scheduled task.\n*\nPOC\n\n\n#win #lpe", "url": "https://t.me/proxy_bar/2871", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2026-08-15T03:55:27.827Z", "date_only": false, "value": "2026-08-15T03:55:27.827Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2025-60710", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-08-15T03:55:27.827Z", "date_only": false, "value": "2026-08-15T03:55:27.827Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2025-60710", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-08-16T02:00:27.460Z", "date_only": false, "value": "2026-08-16T02:00:27.460825Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cvemon.bsky.social/post/3mt63phcrxk2d", "record": "CVE-2025-60710", "field": "creation_timestamp", "uuid": "6fe6bb74-e3aa-4001-93e5-adb434d8876c", "content": "CVE-2025-60710 is trending. Hype score 4, currently #8 on cvemon.\n\nImproper link resolution before file access ('link following') in Host Process for Windows Tasks allows an authorized attacker to elevate privileges locally.\n\nhttps://cvemon.intruder.io/cves/CVE-2025-60710", "url": "https://bsky.app/profile/cvemon.bsky.social/post/3mt63phcrxk2d"}, {"timestamp": "2026-08-18T12:00:03.018Z", "date_only": false, "value": "2026-08-18T12:00:03.018028Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/HackerNewscyber/3343", "record": "CVE-2025-60710", "field": "creation_timestamp", "uuid": "24311f79-7339-4615-80a7-e49482f371eb", "content": "\u2708\ufe0f\u0647\u0634\u062f\u0627\u0631 \u0633\u06cc\u0633\u0627\u061b \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u0648\u06cc\u0646\u062f\u0648\u0632 \u0628\u0647 \u0627\u0628\u0632\u0627\u0631 \u062c\u062f\u06cc\u062f \u06af\u0631\u0648\u0647\u200c\u0647\u0627\u06cc \u0628\u0627\u062c\u200c\u0627\u0641\u0632\u0627\u0631\u06cc \u062a\u0628\u062f\u06cc\u0644 \u0634\u062f\n\n\ud83c\udfa5\u0622\u0698\u0627\u0646\u0633 \u0627\u0645\u0646\u06cc\u062a \u0633\u0627\u06cc\u0628\u0631\u06cc \u0648 \u0627\u0645\u0646\u06cc\u062a \u0632\u06cc\u0631\u0633\u0627\u062e\u062a \u0622\u0645\u0631\u06cc\u06a9\u0627 (\u0633\u06cc\u0633\u0627) \u0627\u0639\u0644\u0627\u0645 \u06a9\u0631\u062f\u0647 \u0627\u0633\u062a \u06a9\u0647 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc CVE-2025-60710 \u062f\u0631 \u0645\u0624\u0644\u0641\u0647 \u0648\u06cc\u0646\u062f\u0648\u0632 Task Host \u062a\u0648\u0633\u0637 \u06af\u0631\u0648\u0647\u200c\u0647\u0627\u06cc \u0628\u0627\u062c\u200c\u0627\u0641\u0632\u0627\u0631\u06cc \u0645\u0648\u0631\u062f \u0633\u0648\u0621\u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0642\u0631\u0627\u0631 \u06af\u0631\u0641\u062a\u0647 \u0627\u0633\u062a.\n\n\ud83c\udfa4\u0627\u06cc\u0646 \u0646\u0642\u0635 \u06a9\u0647 \u062f\u0631 \u0646\u0648\u0627\u0645\u0628\u0631 \u06f2\u06f0\u06f2\u06f5 \u062a\u0648\u0633\u0637 \u0645\u0627\u06cc\u06a9\u0631\u0648\u0633\u0627\u0641\u062a \u0648\u0635\u0644\u0647 \u0634\u062f\u060c \u0627\u0645\u06a9\u0627\u0646 \u0627\u0631\u062a\u0642\u0627\u06cc \u0633\u0637\u062d \u062f\u0633\u062a\u0631\u0633\u06cc \u0627\u0632 \u06a9\u0627\u0631\u0628\u0631 \u0639\u0627\u062f\u06cc \u0628\u0647 \u0633\u0637\u062d SYSTEM \u0631\u0627 \u062f\u0631 \u0648\u06cc\u0646\u062f\u0648\u0632 \u06f1\u06f1 \u0648 \u0648\u06cc\u0646\u062f\u0648\u0632 \u0633\u0631\u0648\u0631 \u06f2\u06f0\u06f2\u06f5 \u0641\u0631\u0627\u0647\u0645 \u0645\u06cc\u200c\u06a9\u0646\u062f.\n\n\ud83c\udfa5\u0633\u06cc\u0633\u0627 \u067e\u06cc\u0634\u200c\u062a\u0631 \u0627\u06cc\u0646 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u0631\u0627 \u062f\u0631 \u0641\u0647\u0631\u0633\u062a \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc\u200c\u0647\u0627\u06cc \u0641\u0639\u0627\u0644\u0627\u064b \u0645\u0648\u0631\u062f \u0628\u0647\u0631\u0647\u200c\u0628\u0631\u062f\u0627\u0631\u06cc \u0642\u0631\u0627\u0631 \u062f\u0627\u062f\u0647 \u0628\u0648\u062f \u0648 \u0627\u06a9\u0646\u0648\u0646 \u0628\u0627 \u062a\u0623\u06cc\u06cc\u062f \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u06af\u0631\u0648\u0647\u200c\u0647\u0627\u06cc \u0628\u0627\u062c\u200c\u0627\u0641\u0632\u0627\u0631\u06cc\u060c \u0628\u0631 \u0636\u0631\u0648\u0631\u062a \u0646\u0635\u0628 \u0641\u0648\u0631\u06cc \u0648\u0635\u0644\u0647\u200c\u0647\u0627\u06cc \u0627\u0645\u0646\u06cc\u062a\u06cc \u0648 \u0627\u062c\u0631\u0627\u06cc \u0627\u0642\u062f\u0627\u0645\u0627\u062a \u06a9\u0627\u0647\u0634\u06cc \u062a\u0648\u0635\u06cc\u0647\u200c\u0634\u062f\u0647 \u062a\u0623\u06a9\u06cc\u062f \u06a9\u0631\u062f\u0647 \u0627\u0633\u062a.\n\n\n\u2708\ufe0f @HackerNewsCyber", "url": "https://t.me/HackerNewscyber/3343"}, {"timestamp": "2026-08-18T15:46:22.321Z", "date_only": false, "value": "2026-08-18T15:46:22.321134Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/suriq.io/post/3mteks4zmgn2p", "record": "CVE-2025-60710", "field": "creation_timestamp", "uuid": "1713823c-da89-45c0-ade9-d6a52d54083d", "content": "CISA now confirms ransomware crews are exploiting CVE-2025-60710, a Windows Task Host flaw that gives a local user SYSTEM.\n\nHits Windows 11 and Server 2025, patched last November.\n\nVerify the build number, not just 'we patched.'", "url": "https://bsky.app/profile/suriq.io/post/3mteks4zmgn2p"}, {"timestamp": "2026-08-18T16:24:28.607Z", "date_only": false, "value": "2026-08-18T16:24:28.607942Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/newssecia.bsky.social/post/3mtemwbx4yx27", "record": "CVE-2025-60710", "field": "creation_timestamp", "uuid": "da3e9bab-54de-4a6e-b0aa-1540bc61e6ff", "content": "\ud83e\udd16 CVE-2025-60710: Windows Task Host LPE now exploited by ransomware gangs (CISA KEV). Low-priv attacker can reach SYSTEM on unpatched Windows 11/Server 2025. Patched Nov 2025.\nhttps://www.bleepingcomputer.com/news/security/cisa-windows-task-host-flaw-now-exploited-by-ransomware-gangs/", "url": "https://bsky.app/profile/newssecia.bsky.social/post/3mtemwbx4yx27"}, {"timestamp": "2026-08-18T19:00:05.643Z", "date_only": false, "value": "2026-08-18T19:00:05.643901Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/VulnerabilityNews/41878", "record": "CVE-2025-60710", "field": "creation_timestamp", "uuid": "31848505-b7d1-4eb1-841a-7d75f1480629", "content": "CISA Adds Seven Known Exploited Vulnerabilities to Catalog\n\nCISA has added seven new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.\nCVE-2012-1854 Microsoft Visual Basic for Applications Insecure Library Loading Vulnerability\nCVE-2020-9715 Adobe Acrobat Use-After-Free Vulnerability\nCVE-2023-21529 Microsoft Exchange Server Deserialization of Untrusted Data Vulnerability\nCVE-2023-36424 Microsoft Windows Out-of-Bounds Read Vulnerability\nCVE-2025-60710 Microsoft Windows Link Following Vulnerability\nCVE-2026-21643 Fortinet SQL Injection Vulnerability\nCVE-2026-34621 Adobe Acrobat and Reader Prototype Pollution Vulnerability\nThese types of vulnerabilities are frequent attack vectors for malicious cyber actors and pose significant risks to the federal enterprise.\nBinding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities established the KEV Catalog as a living list of known Common Vulnerabilities and Exposures (CVEs) that carry significant risk to the federal enterprise. BOD 22-01 requires Federal Civilian Executive Branch (FCEB) agencies to remediate identified vulnerabilities by the due date to protect FCEB networks against active threats. See the BOD 22-01 Fact Sheet for more information.\nAlthough BOD 22-01 only applies to FCEB agencies, CISA strongly urges all organizations to reduce their exposure to cyberattacks by prioritizing timely remediation of KEV Catalog vulnerabilities as part of their vulnerability management practice. CISA will continue to add vulnerabilities to the catalog that meet the specified criteria.\nhttps://www.cisa.gov/news-events/alerts/2026/04/13/cisa-adds-seven-known-exploited-vulnerabilities-catalog", "url": "https://t.me/VulnerabilityNews/41878"}, {"timestamp": "2026-08-19T00:00:08.171Z", "date_only": false, "value": "2026-08-19T00:00:08.171521Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/VulnerabilityNews/41878", "record": "CVE-2025-60710", "field": "creation_timestamp", "uuid": "461d8ee0-e1eb-46e3-97ee-388555e2a4cc", "content": "CISA Adds Seven Known Exploited Vulnerabilities to Catalog\n\nCISA has added seven new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.\nCVE-2012-1854 Microsoft Visual Basic for Applications Insecure Library Loading Vulnerability\nCVE-2020-9715 Adobe Acrobat Use-After-Free Vulnerability\nCVE-2023-21529 Microsoft Exchange Server Deserialization of Untrusted Data Vulnerability\nCVE-2023-36424 Microsoft Windows Out-of-Bounds Read Vulnerability\nCVE-2025-60710 Microsoft Windows Link Following Vulnerability\nCVE-2026-21643 Fortinet SQL Injection Vulnerability\nCVE-2026-34621 Adobe Acrobat and Reader Prototype Pollution Vulnerability\nThese types of vulnerabilities are frequent attack vectors for malicious cyber actors and pose significant risks to the federal enterprise.\nBinding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities established the KEV Catalog as a living list of known Common Vulnerabilities and Exposures (CVEs) that carry significant risk to the federal enterprise. BOD 22-01 requires Federal Civilian Executive Branch (FCEB) agencies to remediate identified vulnerabilities by the due date to protect FCEB networks against active threats. See the BOD 22-01 Fact Sheet for more information.\nAlthough BOD 22-01 only applies to FCEB agencies, CISA strongly urges all organizations to reduce their exposure to cyberattacks by prioritizing timely remediation of KEV Catalog vulnerabilities as part of their vulnerability management practice. CISA will continue to add vulnerabilities to the catalog that meet the specified criteria.\nhttps://www.cisa.gov/news-events/alerts/2026/04/13/cisa-adds-seven-known-exploited-vulnerabilities-catalog", "url": "https://t.me/VulnerabilityNews/41878", "metric_role": "exploitation", "metric_basis": "sighting_report"}, {"timestamp": "2026-08-19T00:00:10.577Z", "date_only": false, "value": "2026-08-19T00:00:10.577500Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/HackerNewscyber/3343", "record": "CVE-2025-60710", "field": "creation_timestamp", "uuid": "ecab7234-2c0a-498c-8078-dd658ad8b5de", "content": "\u2708\ufe0f\u0647\u0634\u062f\u0627\u0631 \u0633\u06cc\u0633\u0627\u061b \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u0648\u06cc\u0646\u062f\u0648\u0632 \u0628\u0647 \u0627\u0628\u0632\u0627\u0631 \u062c\u062f\u06cc\u062f \u06af\u0631\u0648\u0647\u200c\u0647\u0627\u06cc \u0628\u0627\u062c\u200c\u0627\u0641\u0632\u0627\u0631\u06cc \u062a\u0628\u062f\u06cc\u0644 \u0634\u062f\n\n\ud83c\udfa5\u0622\u0698\u0627\u0646\u0633 \u0627\u0645\u0646\u06cc\u062a \u0633\u0627\u06cc\u0628\u0631\u06cc \u0648 \u0627\u0645\u0646\u06cc\u062a \u0632\u06cc\u0631\u0633\u0627\u062e\u062a \u0622\u0645\u0631\u06cc\u06a9\u0627 (\u0633\u06cc\u0633\u0627) \u0627\u0639\u0644\u0627\u0645 \u06a9\u0631\u062f\u0647 \u0627\u0633\u062a \u06a9\u0647 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc CVE-2025-60710 \u062f\u0631 \u0645\u0624\u0644\u0641\u0647 \u0648\u06cc\u0646\u062f\u0648\u0632 Task Host \u062a\u0648\u0633\u0637 \u06af\u0631\u0648\u0647\u200c\u0647\u0627\u06cc \u0628\u0627\u062c\u200c\u0627\u0641\u0632\u0627\u0631\u06cc \u0645\u0648\u0631\u062f \u0633\u0648\u0621\u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0642\u0631\u0627\u0631 \u06af\u0631\u0641\u062a\u0647 \u0627\u0633\u062a.\n\n\ud83c\udfa4\u0627\u06cc\u0646 \u0646\u0642\u0635 \u06a9\u0647 \u062f\u0631 \u0646\u0648\u0627\u0645\u0628\u0631 \u06f2\u06f0\u06f2\u06f5 \u062a\u0648\u0633\u0637 \u0645\u0627\u06cc\u06a9\u0631\u0648\u0633\u0627\u0641\u062a \u0648\u0635\u0644\u0647 \u0634\u062f\u060c \u0627\u0645\u06a9\u0627\u0646 \u0627\u0631\u062a\u0642\u0627\u06cc \u0633\u0637\u062d \u062f\u0633\u062a\u0631\u0633\u06cc \u0627\u0632 \u06a9\u0627\u0631\u0628\u0631 \u0639\u0627\u062f\u06cc \u0628\u0647 \u0633\u0637\u062d SYSTEM \u0631\u0627 \u062f\u0631 \u0648\u06cc\u0646\u062f\u0648\u0632 \u06f1\u06f1 \u0648 \u0648\u06cc\u0646\u062f\u0648\u0632 \u0633\u0631\u0648\u0631 \u06f2\u06f0\u06f2\u06f5 \u0641\u0631\u0627\u0647\u0645 \u0645\u06cc\u200c\u06a9\u0646\u062f.\n\n\ud83c\udfa5\u0633\u06cc\u0633\u0627 \u067e\u06cc\u0634\u200c\u062a\u0631 \u0627\u06cc\u0646 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u0631\u0627 \u062f\u0631 \u0641\u0647\u0631\u0633\u062a \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc\u200c\u0647\u0627\u06cc \u0641\u0639\u0627\u0644\u0627\u064b \u0645\u0648\u0631\u062f \u0628\u0647\u0631\u0647\u200c\u0628\u0631\u062f\u0627\u0631\u06cc \u0642\u0631\u0627\u0631 \u062f\u0627\u062f\u0647 \u0628\u0648\u062f \u0648 \u0627\u06a9\u0646\u0648\u0646 \u0628\u0627 \u062a\u0623\u06cc\u06cc\u062f \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u06af\u0631\u0648\u0647\u200c\u0647\u0627\u06cc \u0628\u0627\u062c\u200c\u0627\u0641\u0632\u0627\u0631\u06cc\u060c \u0628\u0631 \u0636\u0631\u0648\u0631\u062a \u0646\u0635\u0628 \u0641\u0648\u0631\u06cc \u0648\u0635\u0644\u0647\u200c\u0647\u0627\u06cc \u0627\u0645\u0646\u06cc\u062a\u06cc \u0648 \u0627\u062c\u0631\u0627\u06cc \u0627\u0642\u062f\u0627\u0645\u0627\u062a \u06a9\u0627\u0647\u0634\u06cc \u062a\u0648\u0635\u06cc\u0647\u200c\u0634\u062f\u0647 \u062a\u0623\u06a9\u06cc\u062f \u06a9\u0631\u062f\u0647 \u0627\u0633\u062a.\n\n\n\u2708\ufe0f @HackerNewsCyber", "url": "https://t.me/HackerNewscyber/3343", "metric_role": "exploitation", "metric_basis": "sighting_report"}, {"timestamp": "2026-08-29T20:00:05.555Z", "date_only": false, "value": "2026-08-29T20:00:05.555949Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/CyberDispatch/2587", "record": "CVE-2025-60710", "field": "creation_timestamp", "uuid": "97e98c83-11be-40f7-bc0c-ce95e17ba467", "content": "The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has announced that ransomware groups are exploiting the CVE-2025-60710 vulnerability in the Windows Task Host component.", "url": "https://t.me/CyberDispatch/2587"}, {"timestamp": "2026-08-30T00:00:38.464Z", "date_only": false, "value": "2026-08-30T00:00:38.464190Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/CyberDispatch/2587", "record": "CVE-2025-60710", "field": "creation_timestamp", "uuid": "fbd75fce-2c0a-4fa1-a822-c1d8e56c14ee", "content": "The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has announced that ransomware groups are exploiting the CVE-2025-60710 vulnerability in the Windows Task Host component.", "url": "https://t.me/CyberDispatch/2587", "metric_role": "exploitation", "metric_basis": "sighting_report"}, {"timestamp": "2026-09-12T12:00:04.894Z", "date_only": false, "value": "2026-09-12T12:00:04.894136Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/gThV_jQpWo9C9Hh6mwOWCdeHifGtlzQmwSFlugdchYu9bYI", "record": "CVE-2025-60710", "field": "creation_timestamp", "uuid": "f209175d-e6e7-4354-a6e4-76eb00ea81f6", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2026-09-12T18:00:05.640Z", "date_only": false, "value": "2026-09-12T18:00:05.640163Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/B0GjQGdKvfJNz3pIq4GMdhjHw_2Itc133F7Yfpv0oo-rgxs", "record": "CVE-2025-60710", "field": "creation_timestamp", "uuid": "1041364e-094e-439c-bfaf-619251f5d379", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2026-09-12T22:00:05.200Z", "date_only": false, "value": "2026-09-12T22:00:05.200809Z", "kind": "sighting", "label": "Seen", "source": "Telegram/_rItvzkAb6lBsciRTCFtujZgFYUrYrqXSx0XYWYVwtC5JZw", "record": "CVE-2025-60710", "field": "creation_timestamp", "uuid": "418a11d9-a4ad-4707-94ef-ff51370181f1"}, {"timestamp": "2026-09-13T00:00:06.611Z", "date_only": false, "value": "2026-09-13T00:00:06.611187Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/_rItvzkAb6lBsciRTCFtujZgFYUrYrqXSx0XYWYVwtC5JZw", "record": "CVE-2025-60710", "field": "creation_timestamp", "uuid": "03110e18-a063-4b29-bc9b-4659ac95f644", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2026-09-13T05:00:04.205Z", "date_only": false, "value": "2026-09-13T05:00:04.205936Z", "kind": "sighting", "label": "Seen", "source": "Telegram/wJIOJg7zanHnVyyI798_fwaJpOpzvcGiO4zWBe597cvOE_Q", "record": "CVE-2025-60710", "field": "creation_timestamp", "uuid": "f60d6968-af8a-4306-bfc5-dba38d0041fd"}, {"timestamp": "2026-09-13T15:00:05.630Z", "date_only": false, "value": "2026-09-13T15:00:05.630537Z", "kind": "sighting", "label": "Seen", "source": "Telegram/uUtnno_VEuouvWhn_29Osxsno0-8bymP_h88l7hsSYncMeY", "record": "CVE-2025-60710", "field": "creation_timestamp", "uuid": "3e87eae6-0eb0-4b9d-87a3-113339aabb55"}, {"timestamp": "2026-09-13T19:00:06.407Z", "date_only": false, "value": "2026-09-13T19:00:06.407762Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/eolgh6aLS4rgSnR6Z-zHifxEeNBV1ThDpQWe37SgOUT7I1o", "record": "CVE-2025-60710", "field": "creation_timestamp", "uuid": "f2ff9356-3b2d-45fd-827b-6eed03aa3eab", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2026-09-14T00:00:09.206Z", "date_only": false, "value": "2026-09-14T00:00:09.206394Z", "kind": "sighting", "label": "Seen", "source": "Telegram/jh0whM22Atq8OS912YyotgrPw8UHGX4MBmJa5R4nvwF36is", "record": "CVE-2025-60710", "field": "creation_timestamp", "uuid": "e295666b-7319-45d9-9e12-6531ffda71f5"}, {"timestamp": "2026-09-14T00:00:12.513Z", "date_only": false, "value": "2026-09-14T00:00:12.513102Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/uUtnno_VEuouvWhn_29Osxsno0-8bymP_h88l7hsSYncMeY", "record": "CVE-2025-60710", "field": "creation_timestamp", "uuid": "3c16f656-42de-4204-94eb-a1fdf62c1e93", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2026-09-14T00:00:30.887Z", "date_only": false, "value": "2026-09-14T00:00:30.887580Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/wJIOJg7zanHnVyyI798_fwaJpOpzvcGiO4zWBe597cvOE_Q", "record": "CVE-2025-60710", "field": "creation_timestamp", "uuid": "277079f9-3a61-4ea7-854f-5ed736671365", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2026-09-14T04:00:03.819Z", "date_only": false, "value": "2026-09-14T04:00:03.819178Z", "kind": "sighting", "label": "Seen", "source": "Telegram/rYI6Zqy0cIAzPuGO9f0r5Slky12gBs9q9iDC78xwtWgP4zQ", "record": "CVE-2025-60710", "field": "creation_timestamp", "uuid": "65cfc285-2fb2-4f05-907b-1d0efd0decb3"}, {"timestamp": "2026-09-14T15:00:04.241Z", "date_only": false, "value": "2026-09-14T15:00:04.241918Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/gE-0GBB0kiYGrYaMb2QcTMVYdqqOK5zcUTgdZJ7ydzauL8M", "record": "CVE-2025-60710", "field": "creation_timestamp", "uuid": "5e64f9d2-7a80-43e5-87eb-859007b23f21", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2026-09-14T20:00:05.808Z", "date_only": false, "value": "2026-09-14T20:00:05.808487Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/JQD0C8Yx27tRSZoKZpdm0Z4-Mq7L_VGqhn-eJGwBkI0rYps", "record": "CVE-2025-60710", "field": "creation_timestamp", "uuid": "5f23d5d9-e16a-4548-a5d8-c7234227ebd0", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2026-09-15T00:00:30.910Z", "date_only": false, "value": "2026-09-15T00:00:30.910354Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/rYI6Zqy0cIAzPuGO9f0r5Slky12gBs9q9iDC78xwtWgP4zQ", "record": "CVE-2025-60710", "field": "creation_timestamp", "uuid": "1f612d1c-a609-4fad-afd5-ec2b02e3b34a", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2026-09-15T00:00:31.923Z", "date_only": false, "value": "2026-09-15T00:00:31.923364Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/jh0whM22Atq8OS912YyotgrPw8UHGX4MBmJa5R4nvwF36is", "record": "CVE-2025-60710", "field": "creation_timestamp", "uuid": "ca1950ce-f616-4aa1-8daf-00b1562c7ecd", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2026-09-15T01:00:03.465Z", "date_only": false, "value": "2026-09-15T01:00:03.465650Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/H0eOjHyZUxgnLxua8sMakUK5GgA6Gq51QUerHtt7h7qjAfg", "record": "CVE-2025-60710", "field": "creation_timestamp", "uuid": "62ec8ddc-da4c-4634-9268-e3b03e89e0a5", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2026-09-15T07:00:05.386Z", "date_only": false, "value": "2026-09-15T07:00:05.386620Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/BfOP9C6VTcRtW_Rt0HWgkUpUGQT8zRkGvBuU-FkApQscmcE", "record": "CVE-2025-60710", "field": "creation_timestamp", "uuid": "cbc6746c-5c85-4654-b658-fd9f40e97046", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2026-09-15T20:00:04.264Z", "date_only": false, "value": "2026-09-15T20:00:04.264943Z", "kind": "sighting", "label": "Seen", "source": "Telegram/niNQRbFjRj7-WOy4GHjOmH7Q5xMcBDn_2PEfNEn_CK5DWYk", "record": "CVE-2025-60710", "field": "creation_timestamp", "uuid": "91dc02e6-f396-4288-a17d-12a062e3de4d"}, {"timestamp": "2026-09-15T23:00:05.769Z", "date_only": false, "value": "2026-09-15T23:00:05.769112Z", "kind": "sighting", "label": "Seen", "source": "Telegram/7P4z3NQA_03g7yF1iSfMT2p_wGiNpR3Cl-vzoXMZ3imHeg0", "record": "CVE-2025-60710", "field": "creation_timestamp", "uuid": "d8712917-e244-4b71-9f2a-634a4803407c"}, {"timestamp": "2026-09-16T00:00:08.044Z", "date_only": false, "value": "2026-09-16T00:00:08.044940Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/7P4z3NQA_03g7yF1iSfMT2p_wGiNpR3Cl-vzoXMZ3imHeg0", "record": "CVE-2025-60710", "field": "creation_timestamp", "uuid": "8703793a-3d56-4455-a1b9-7f3dfe1a10e2", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2026-09-16T00:00:12.443Z", "date_only": false, "value": "2026-09-16T00:00:12.443795Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/niNQRbFjRj7-WOy4GHjOmH7Q5xMcBDn_2PEfNEn_CK5DWYk", "record": "CVE-2025-60710", "field": "creation_timestamp", "uuid": "0730ed12-475b-4ef1-8be9-7ddd456e7ea1", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2026-09-17T07:00:03.980Z", "date_only": false, "value": "2026-09-17T07:00:03.980599Z", "kind": "sighting", "label": "Seen", "source": "Telegram/4Wb_gm8msPHaxN0KQCo0aAnT96FjiT7skkzpwT214G_FDGI", "record": "CVE-2025-60710", "field": "creation_timestamp", "uuid": "c4452569-bf58-4ab1-9489-82487adf9aa3"}, {"timestamp": "2026-09-18T00:00:09.453Z", "date_only": false, "value": "2026-09-18T00:00:09.453523Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/4Wb_gm8msPHaxN0KQCo0aAnT96FjiT7skkzpwT214G_FDGI", "record": "CVE-2025-60710", "field": "creation_timestamp", "uuid": "c4d6a338-2898-42fb-9395-1fcc09660a38", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2026-09-25T09:13:53Z", "date_only": false, "value": "2026-09-25T09:13:53.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/M7vC2XHTTtUlu53IS3udaeGwL67e6S6vQOz5qVExbOKM--I", "record": "CVE-2025-60710", "field": "creation_timestamp", "uuid": "3f8bd84a-9c0d-4a65-8ac1-a123ecb96f47", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2026-09-25T09:13:53Z", "date_only": false, "value": "2026-09-25T09:13:53.000000Z", "kind": "sighting", "label": "Seen", "source": "Telegram/M7vC2XHTTtUlu53IS3udaeGwL67e6S6vQOz5qVExbOKM--I", "record": "CVE-2025-60710", "field": "creation_timestamp", "uuid": "83170c89-4db4-490d-9f54-3f7d1038d9ea"}, {"timestamp": "2026-10-18T21:10:00.120Z", "date_only": false, "value": "2026-10-18T21:10:00.120", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2025-60710", "record": "FKIE_CVE-2025-60710", "field": "lastModified", "linked_record": true}, {"timestamp": "2026-10-25T07:00:15Z", "date_only": false, "value": "2026-10-25T07:00:15.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/Cw4GIT4AzYoxShMyHHfYFeCo4DN6NYbB2ExKV556MxkxHJs", "record": "CVE-2025-60710", "field": "creation_timestamp", "uuid": "b375443d-6f7b-4db2-818f-b4dd98caa420", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2026-10-25T07:00:15Z", "date_only": false, "value": "2026-10-25T07:00:15.000000Z", "kind": "sighting", "label": "Seen", "source": "Telegram/Cw4GIT4AzYoxShMyHHfYFeCo4DN6NYbB2ExKV556MxkxHJs", "record": "CVE-2025-60710", "field": "creation_timestamp", "uuid": "dc2ae807-f103-4bfa-9b80-2e7b0b3f4830"}, {"timestamp": "2026-11-04T13:31:51Z", "date_only": false, "value": "2026-11-04T13:31:51+00:00", "kind": "kev", "label": "Recorded", "source": "cisa-kev", "record": "CVE-2025-60710", "field": "timestamps.recorded_at", "metric_role": "exploitation_report", "metric_basis": "kev_report", "batch_listing": true, "uuid": "102895ab-d4c1-4ccf-b753-c566efcf9709", "status": {"status_reason": "confirmed", "exploited": true}}], "metrics": {"as_of": "2026-11-14T05:13:32.738Z", "anchors": {"origin": {"timestamp": "2025-11-11T08:00:00Z", "date_only": false, "value": "2025-11-11T08:00:00.000Z", "kind": "milestone", "label": "Published", "source": "csaf_microsoft \u00b7 MSRC_CVE-2025-60710", "record": "MSRC_CVE-2025-60710", "field": "document.tracking.initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, "discovery": null, "report": null, "acknowledgement": null, "disclosure": {"timestamp": "2025-11-11T08:00:00Z", "date_only": false, "value": "2025-11-11T08:00:00.000Z", "kind": "milestone", "label": "Published", "source": "csaf_microsoft \u00b7 MSRC_CVE-2025-60710", "record": "MSRC_CVE-2025-60710", "field": "document.tracking.initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, "exploit_publication": {"timestamp": "2025-11-12T09:10:47Z", "date_only": false, "value": "2025-11-12T09:10:47.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/P0x3k_1N73LL1G3NC3/196", "record": "CVE-2025-60710", "field": "creation_timestamp", "uuid": "9996f3d7-97b0-4de2-b4d5-fc77a168e861", "content": "CVE-2025-60710 Local Privilege Escalation in Taskhost Windows Tasks\n\nThis is PoC for local privilege escalation vulnerability in \\Microsoft\\Windows\\WindowsAI\\Recall\\PolicyConfiguration scheduled task.\nWhen this scheduled task is started the taskhostw.exe process whill try to open the C:\\Users\\%username%\\AppData\\Local\\CoreAIPlatform.00\\UKP directory and search for directories using the following filter: {????????-????-????-????-????????????}. If that directory is found it will be deleted without checking for symbolic links.\nAs low privilege user by default can create directories in their own %LOCALAPPDATA% folder this leads to arbitrary folder delete in context of NT AUTHORITY\\SYSTEM user.", "url": "https://t.me/P0x3k_1N73LL1G3NC3/196", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, "exploitation": {"timestamp": "2026-04-13T00:00:00Z", "date_only": false, "value": "2026-04-13T00:00:00+00:00", "kind": "kev", "label": "Asserted", "source": "cisa-kev", "record": "CVE-2025-60710", "field": "timestamps.asserted_at", "metric_role": "exploitation_report", "metric_basis": "kev_report", "uuid": "102895ab-d4c1-4ccf-b753-c566efcf9709", "status": {"status_reason": "confirmed", "exploited": true}}, "patch": {"timestamp": "2025-11-11T08:00:00Z", "date_only": false, "value": "2025-11-11T08:00:00.000Z", "kind": "other", "label": "Vendor fix", "source": "csaf_microsoft \u00b7 MSRC_CVE-2025-60710", "record": "MSRC_CVE-2025-60710", "field": "vulnerabilities.0.remediations.0.date", "metric_role": "patch", "metric_basis": "recorded_event", "linked_record": true}}, "vendor_response_time": {"available": false, "missing": ["start", "end"]}, "time_to_exploit": {"available": true, "seconds": 13190400.0, "hours": 3664.0, "days": 152.66666666666666, "min_seconds": 13190400.0, "max_seconds": 13276800.0, "approximate": true, "ongoing": false, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2025-11-11T08:00:00Z", "date_only": false, "value": "2025-11-11T08:00:00.000Z", "kind": "milestone", "label": "Published", "source": "csaf_microsoft \u00b7 MSRC_CVE-2025-60710", "record": "MSRC_CVE-2025-60710", "field": "document.tracking.initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, "end": {"timestamp": "2026-04-13T00:00:00Z", "date_only": false, "value": "2026-04-13T00:00:00+00:00", "kind": "kev", "label": "Asserted", "source": "cisa-kev", "record": "CVE-2025-60710", "field": "timestamps.asserted_at", "metric_role": "exploitation_report", "metric_basis": "kev_report", "uuid": "102895ab-d4c1-4ccf-b753-c566efcf9709", "status": {"status_reason": "confirmed", "exploited": true}}}, "disclosure_to_exploit": {"available": true, "seconds": 13190400.0, "hours": 3664.0, "days": 152.66666666666666, "min_seconds": 13190400.0, "max_seconds": 13276800.0, "approximate": true, "ongoing": false, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2025-11-11T08:00:00Z", "date_only": false, "value": "2025-11-11T08:00:00.000Z", "kind": "milestone", "label": "Published", "source": "csaf_microsoft \u00b7 MSRC_CVE-2025-60710", "record": "MSRC_CVE-2025-60710", "field": "document.tracking.initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, "end": {"timestamp": "2026-04-13T00:00:00Z", "date_only": false, "value": "2026-04-13T00:00:00+00:00", "kind": "kev", "label": "Asserted", "source": "cisa-kev", "record": "CVE-2025-60710", "field": "timestamps.asserted_at", "metric_role": "exploitation_report", "metric_basis": "kev_report", "uuid": "102895ab-d4c1-4ccf-b753-c566efcf9709", "status": {"status_reason": "confirmed", "exploited": true}}}, "disclosure_to_exploit_publication": {"available": true, "seconds": 90647.0, "hours": 25.17972222222222, "days": 1.0491550925925925, "min_seconds": 90647.0, "max_seconds": 90647.0, "approximate": false, "ongoing": false, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2025-11-11T08:00:00Z", "date_only": false, "value": "2025-11-11T08:00:00.000Z", "kind": "milestone", "label": "Published", "source": "csaf_microsoft \u00b7 MSRC_CVE-2025-60710", "record": "MSRC_CVE-2025-60710", "field": "document.tracking.initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, "end": {"timestamp": "2025-11-12T09:10:47Z", "date_only": false, "value": "2025-11-12T09:10:47.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/P0x3k_1N73LL1G3NC3/196", "record": "CVE-2025-60710", "field": "creation_timestamp", "uuid": "9996f3d7-97b0-4de2-b4d5-fc77a168e861", "content": "CVE-2025-60710 Local Privilege Escalation in Taskhost Windows Tasks\n\nThis is PoC for local privilege escalation vulnerability in \\Microsoft\\Windows\\WindowsAI\\Recall\\PolicyConfiguration scheduled task.\nWhen this scheduled task is started the taskhostw.exe process whill try to open the C:\\Users\\%username%\\AppData\\Local\\CoreAIPlatform.00\\UKP directory and search for directories using the following filter: {????????-????-????-????-????????????}. If that directory is found it will be deleted without checking for symbolic links.\nAs low privilege user by default can create directories in their own %LOCALAPPDATA% folder this leads to arbitrary folder delete in context of NT AUTHORITY\\SYSTEM user.", "url": "https://t.me/P0x3k_1N73LL1G3NC3/196", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}}, "time_to_patch": {"available": false, "missing": ["start"]}, "total_time_to_patch": {"available": false, "missing": ["start"]}, "disclosure_to_patch": {"available": true, "seconds": 0.0, "hours": 0.0, "days": 0.0, "min_seconds": 0.0, "max_seconds": 0.0, "approximate": false, "ongoing": false, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2025-11-11T08:00:00Z", "date_only": false, "value": "2025-11-11T08:00:00.000Z", "kind": "milestone", "label": "Published", "source": "csaf_microsoft \u00b7 MSRC_CVE-2025-60710", "record": "MSRC_CVE-2025-60710", "field": "document.tracking.initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, "end": {"timestamp": "2025-11-11T08:00:00Z", "date_only": false, "value": "2025-11-11T08:00:00.000Z", "kind": "other", "label": "Vendor fix", "source": "csaf_microsoft \u00b7 MSRC_CVE-2025-60710", "record": "MSRC_CVE-2025-60710", "field": "vulnerabilities.0.remediations.0.date", "metric_role": "patch", "metric_basis": "recorded_event", "linked_record": true}}, "time_unpatched": {"available": true, "seconds": 0.0, "hours": 0.0, "days": 0.0, "min_seconds": 0.0, "max_seconds": 0.0, "approximate": false, "ongoing": false, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2025-11-11T08:00:00Z", "date_only": false, "value": "2025-11-11T08:00:00.000Z", "kind": "milestone", "label": "Published", "source": "csaf_microsoft \u00b7 MSRC_CVE-2025-60710", "record": "MSRC_CVE-2025-60710", "field": "document.tracking.initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, "end": {"timestamp": "2025-11-11T08:00:00Z", "date_only": false, "value": "2025-11-11T08:00:00.000Z", "kind": "other", "label": "Vendor fix", "source": "csaf_microsoft \u00b7 MSRC_CVE-2025-60710", "record": "MSRC_CVE-2025-60710", "field": "vulnerabilities.0.remediations.0.date", "metric_role": "patch", "metric_basis": "recorded_event", "linked_record": true}}, "exploitation_to_patch": {"available": true, "seconds": -13190400.0, "hours": -3664.0, "days": -152.66666666666666, "min_seconds": -13276800.0, "max_seconds": -13190400.0, "approximate": true, "ongoing": false, "order_known": true, "batch_listing": false, "end_before_start": true, "start": {"timestamp": "2026-04-13T00:00:00Z", "date_only": false, "value": "2026-04-13T00:00:00+00:00", "kind": "kev", "label": "Asserted", "source": "cisa-kev", "record": "CVE-2025-60710", "field": "timestamps.asserted_at", "metric_role": "exploitation_report", "metric_basis": "kev_report", "uuid": "102895ab-d4c1-4ccf-b753-c566efcf9709", "status": {"status_reason": "confirmed", "exploited": true}}, "end": {"timestamp": "2025-11-11T08:00:00Z", "date_only": false, "value": "2025-11-11T08:00:00.000Z", "kind": "other", "label": "Vendor fix", "source": "csaf_microsoft \u00b7 MSRC_CVE-2025-60710", "record": "MSRC_CVE-2025-60710", "field": "vulnerabilities.0.remediations.0.date", "metric_role": "patch", "metric_basis": "recorded_event", "linked_record": true}}, "exploit_publication_to_patch": {"available": true, "seconds": -90647.0, "hours": -25.17972222222222, "days": -1.0491550925925925, "min_seconds": -90647.0, "max_seconds": -90647.0, "approximate": false, "ongoing": false, "order_known": true, "batch_listing": false, "end_before_start": true, "start": {"timestamp": "2025-11-12T09:10:47Z", "date_only": false, "value": "2025-11-12T09:10:47.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/P0x3k_1N73LL1G3NC3/196", "record": "CVE-2025-60710", "field": "creation_timestamp", "uuid": "9996f3d7-97b0-4de2-b4d5-fc77a168e861", "content": "CVE-2025-60710 Local Privilege Escalation in Taskhost Windows Tasks\n\nThis is PoC for local privilege escalation vulnerability in \\Microsoft\\Windows\\WindowsAI\\Recall\\PolicyConfiguration scheduled task.\nWhen this scheduled task is started the taskhostw.exe process whill try to open the C:\\Users\\%username%\\AppData\\Local\\CoreAIPlatform.00\\UKP directory and search for directories using the following filter: {????????-????-????-????-????????????}. If that directory is found it will be deleted without checking for symbolic links.\nAs low privilege user by default can create directories in their own %LOCALAPPDATA% folder this leads to arbitrary folder delete in context of NT AUTHORITY\\SYSTEM user.", "url": "https://t.me/P0x3k_1N73LL1G3NC3/196", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, "end": {"timestamp": "2025-11-11T08:00:00Z", "date_only": false, "value": "2025-11-11T08:00:00.000Z", "kind": "other", "label": "Vendor fix", "source": "csaf_microsoft \u00b7 MSRC_CVE-2025-60710", "record": "MSRC_CVE-2025-60710", "field": "vulnerabilities.0.remediations.0.date", "metric_role": "patch", "metric_basis": "recorded_event", "linked_record": true}}}}