CyberHappenings logo
☰
Home Browse Watchlists Experimental About

Track cybersecurity events as they unfold. Sourced timelines. Filter, sort, and browse. Fast, privacy‑respecting. No invasive ads, no tracking.

Windows privilege escalation via MiniPlasma zero-day in Cloud Filter driver

First reported
Last updated
1 unique sources, 1 articles

Summary

Hide ▲

A new Windows privilege escalation zero-day named MiniPlasma has been publicly disclosed, enabling attackers to escalate privileges to SYSTEM on fully patched Windows systems. The vulnerability resides in the Cloud Filter driver (cldflt.sys) and its HsmOsBlockPlaceholderAccess routine, impacting the .DEFAULT user hive registry key creation through undocumented CfAbortHydration API calls. The exploit provides SYSTEM-level command shell access, confirmed on Windows 11 Pro with May 2026 Patch Tuesday updates but non-functional in the Windows 11 Insider Preview Canary build. The flaw was originally reported to Microsoft in September 2020 as CVE-2020-17103 and allegedly patched in December 2020, yet the researcher claims the same issue remains exploitable, suggesting patch failure or rollback. Microsoft has not publicly addressed the new disclosure as of publication.

Timeline

  1. 18.05.2026 01:30 1 articles · 6h ago

    MiniPlasma zero-day exploit for Cloud Filter driver privilege escalation disclosed

    Public disclosure of MiniPlasma exploit for an unpatched Windows privilege escalation vulnerability affecting the Cloud Filter driver (cldflt.sys). The exploit achieves SYSTEM privileges via registry manipulation in the .DEFAULT user hive using undocumented CfAbortHydration API calls. PoC released by researcher Chaotic Eclipse after claims that Microsoft's 2020 patch for CVE-2020-17103 failed to fully remediate the issue. Confirmed functional on Windows 11 Pro with May 2026 updates but not in Windows 11 Insider Preview Canary builds.

    Show sources
    Open in new tab

Information Snippets