CVE-2025-60705 Overview
CVE-2025-60705 is an improper access control vulnerability [CWE-284] in the Windows Client-Side Caching (CSC) Service. An authorized local attacker can exploit this flaw to elevate privileges on the affected system. Microsoft published the advisory on November 11, 2025, covering a broad range of Windows client and server operating systems.
The vulnerability requires local access and low privileges, but no user interaction. Successful exploitation compromises confidentiality, integrity, and availability of the target host. The EPSS score is 2.351% with a percentile of 81.934, indicating higher-than-average likelihood of exploitation activity compared to the broader CVE population.
Critical Impact
A low-privileged local user can elevate to SYSTEM by abusing improper access control in the Windows CSC Service, achieving full host compromise.
Affected Products
- Microsoft Windows 10 (1607, 1809, 21H2, 22H2) and Windows 11 (23H2, 24H2, 25H2)
- Microsoft Windows Server 2008, 2012, 2016, 2019, 2022, and 2025
- Microsoft Windows Server 2022 23H2
Discovery Timeline
- 2025-11-11 - CVE-2025-60705 published to NVD
- 2025-11-11 - Microsoft releases security update guidance via MSRC
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-60705
Vulnerability Analysis
The Windows Client-Side Caching (CSC) Service manages offline file access, allowing users to work with network files when disconnected from the network. The service caches remote file content locally and synchronizes changes when connectivity is restored.
CVE-2025-60705 stems from improper enforcement of access control within CSC service operations. An authenticated local attacker can leverage this weakness to perform actions or access resources that should be restricted to higher-privileged principals. The result is local privilege escalation, typically to SYSTEM context.
Root Cause
The root cause maps to CWE-284 (Improper Access Control). The CSC service fails to correctly validate the security context of the caller or the target resource before performing privileged operations. This gap allows a low-privileged process to influence service behavior in ways that grant elevated file, registry, or process access.
Attack Vector
Exploitation requires local access with a valid low-privileged account. The attacker interacts with the CSC service through its exposed interfaces and manipulates cached file operations, synchronization primitives, or object permissions to induce the service to act on attacker-controlled paths. Successful exploitation yields code execution or file write primitives under a higher-privileged security context.
No public proof-of-concept is available at the time of writing, and Microsoft has not reported observed in-the-wild exploitation. Refer to the Microsoft CVE-2025-60705 Update for technical specifics.
Detection Methods for CVE-2025-60705
Indicators of Compromise
- Unexpected CscService (Client-Side Caching) child processes running under SYSTEM or spawning command interpreters such as cmd.exe or powershell.exe.
- File writes into protected paths (for example C:\Windows\System32\ or C:\Windows\Tasks\) originating from processes tied to the CSC service context.
- Anomalous access or modification of the offline files store under C:\Windows\CSC\ by non-administrative users.
Detection Strategies
- Hunt for token impersonation or handle duplication events (Sysmon Event ID 10) where a low-privileged process targets svchost.exe hosting the CSC service.
- Alert on new service, scheduled task, or driver creation immediately following CSC service activity by a non-administrative session.
- Correlate 4688 process creation events showing privilege elevation without a corresponding legitimate elevation source (UAC prompt, RunAs).
Monitoring Recommendations
- Enable command-line auditing and PowerShell script block logging on all endpoints running affected Windows versions.
- Forward Sysmon, Security, and Application event logs to a centralized SIEM or data lake for cross-host correlation.
- Baseline normal CSC service activity so deviations tied to interactive user sessions are flagged for review.
How to Mitigate CVE-2025-60705
Immediate Actions Required
- Apply the November 2025 Microsoft security update referenced in the MSRC advisory for CVE-2025-60705 to all affected Windows client and server systems.
- Prioritize patching multi-user hosts such as terminal servers, VDI infrastructure, and shared workstations where low-privileged users execute code.
- Audit accounts with interactive logon rights and reduce the local logon footprint on servers where possible.
Patch Information
Microsoft has released security updates addressing CVE-2025-60705 across all supported affected products. Administrators should consult the Microsoft CVE-2025-60705 Update page to obtain the correct KB article and update package for each Windows build in the environment. Deploy through Windows Update, WSUS, Microsoft Configuration Manager, or Intune following standard change management.
Workarounds
- Disable the Offline Files feature on systems that do not require it via Group Policy under Computer Configuration\Administrative Templates\Network\Offline Files.
- Stop and disable the CscService where offline file caching is not a business requirement, then validate that no users rely on offline access.
- Restrict interactive and remote interactive logon rights so untrusted users cannot obtain the local session required for exploitation.
# Disable the Client-Side Caching service on hosts that do not require Offline Files
sc.exe config CscService start= disabled
sc.exe stop CscService
# Verify service state
sc.exe query CscService
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
