CISA Confirms Ransomware Gangs Now Exploiting Windows Task Host Bug
CISA has updated its guidance on a high-severity Windows Task Host vulnerability, confirming that ransomware groups are now weaponizing the flaw in real-world attacks. The bug was first added to CISA's Known Exploited Vulnerabilities catalog back in April after evidence surfaced that attackers were already abusing it, though details at the time suggested more targeted use.
The agency's latest warning signals a shift from limited exploitation to broader adoption by financially motivated ransomware crews, who tend to move quickly once a working exploit proves reliable. Windows Task Host handles scheduled and background tasks system-wide, making it an attractive target for attackers seeking to execute malicious code or escalate privileges on compromised machines.
Organizations that haven't yet applied Microsoft's patch for this vulnerability are urged to do so immediately, as federal agencies face mandatory deadlines under CISA directives.