MiniPlasma Zero-Day Grants SYSTEM Access on Fully Patched Windows

A security researcher has made public a working proof-of-concept for an unpatched Windows privilege-escalation vulnerability nicknamed MiniPlasma, allowing any local account to obtain SYSTEM rights on up-to-date systems.

The code and compiled binary were uploaded to GitHub by an individual operating under the names Chaotic Eclipse and Nightmare Eclipse. The researcher asserts that Microsoft left a flaw originally reported in 2020 unresolved.

The bug resides in the cldflt.sys Cloud Filter driver, specifically inside its HsmOsBlockPlaceholderAccess routine. Google Project Zero’s James Forshaw had notified Microsoft of the identical problem in September 2020; the company assigned CVE-2020-17103 and stated it was corrected the following December.

“After investigating, it turns out the exact same issue that was reported to Microsoft by Google project zero is actually still present, unpatched,” explains Chaotic Eclipse. “I’m unsure if Microsoft just never patched the issue or the patch was silently rolled back at some point for unknown reasons. The original PoC by Google worked without any changes.”

BleepingComputer ran the exploit on a fully updated Windows 11 Pro workstation that included the May 2026 Patch Tuesday fixes. Execution from a standard user account immediately spawned an elevated command prompt running as SYSTEM.

Will Dormann, principal vulnerability analyst at Tharros, independently verified that the PoC succeeds on the current public release of Windows 11 yet fails inside the newest Windows 11 Insider Preview Canary build.

The technique leverages an undocumented CfAbortHydration API to manipulate registry-key creation inside the Cloud Filter driver. Forshaw’s original analysis indicated the flaw permitted arbitrary keys to be written to the .DEFAULT hive without the normal permission checks, which can be chained into privilege escalation.

Although Microsoft declared the issue resolved in its December 2020 Patch Tuesday, Chaotic Eclipse maintains the vulnerability remains exploitable. BleepingComputer has asked Microsoft for comment and will append any reply to this article.

Update 5/18/26: ZeroTrust platform ThreatLocker posted on X that organizations should monitor the following Registry keys for modifications using their EDR platform to detect exploitation: \Registry\User\Software\Policies\Microsoft\CloudFiles\BlockedApps* and \Registry\User\.DEFAULT\Volatile Environment*.

MiniPlasma continues a recent pattern of zero-day releases from the same researcher. The sequence started in April with BlueHammer (CVE-2026-33825), followed by the RedSun privilege-escalation flaw and the UnDefend Windows Defender denial-of-service utility; all three were later observed in real attacks. The researcher says Microsoft addressed RedSun silently without issuing a CVE. In May the same individual published YellowKey, a BitLocker bypass that launches a command shell with access to TPM-only protected drives on Windows 11 and Windows Server 2022/2025, as well as the GreenPlasma exploit.

Chaotic Eclipse has said the public disclosures protest Microsoft’s bug-bounty and vulnerability-response practices. “Normally, I would go through the process of begging them to fix a bug but to summarize, I was told personally by them that they will ruin my life and they did and I’m not sure if I was the only who had this horride experience or few people did but I think most would just eat it and cut their losses but for me, they took away everything,” alleged the researcher. “They mopped the floor with me and pulled every childish game they could. It was soo bad at some point I was wondering if I was dealing with a massive corporation or someone who is just having fun seeing me suffer but it seems to be a collective decision.”

Microsoft has previously told BleepingComputer that it supports coordinated vulnerability disclosure and remains committed to investigating reports and shielding customers with updates.