A cybersecurity researcher has launched a proof-of-concept exploit for a Home windows privilege escalation zero-day dubbed “MiniPlasma” that lets attackers acquire SYSTEM privileges on totally patched Home windows programs.
The exploit was revealed by a researcher often called Chaotic Eclipse, or Nightmare Eclipse, who launched each the supply code and a compiled executable on GitHub after claiming that Microsoft did not correctly patch a beforehand reported 2020 vulnerability.
In keeping with the researcher, the flaw impacts the ‘cldflt.sys‘ Cloud Filter driver and its ‘HsmOsBlockPlaceholderAccess‘ routine, which was initially reported to Microsoft by Google Challenge Zero researcher James Forshaw in September 2020.
On the time, the flaw was assigned the CVE-2020-17103 identifier and reportedly fastened in December 2020.
“After investigating, it seems the very same challenge that was reported to Microsoft by Google challenge zero is definitely nonetheless current, unpatched,” explains Chaotic Eclipse.
“I am not sure if Microsoft simply by no means patched the problem or the patch was silently rolled again in some unspecified time in the future for unknown causes. The unique PoC by Google labored with none adjustments.”
BleepingComputer examined the exploit on a totally patched Home windows 11 Professional system working the newest Could 2026 Patch Tuesday updates.
In our check, we used a typical consumer account, and after working the exploit, it opened a command immediate with SYSTEM privileges, as proven within the picture beneath.
Supply: BleepingComputer
Will Dormann, principal vulnerability analyst at Tharros, additionally confirmed the exploit works in his exams on the newest public model of Home windows 11. Nevertheless, he mentioned that the flaw doesn’t work within the newest Home windows 11 Insider Preview Canary construct.
The exploit seems to abuse how the Home windows Cloud Filter driver handles registry key creation by an undocumented CfAbortHydration API. Forshaw’s unique report mentioned that the flaw might permit arbitrary registry keys to be created within the .DEFAULT consumer hive with out correct entry checks, probably enabling privilege escalation.
Whereas Microsoft stories having fastened the bug as a part of its December 2020 Microsoft Patch Tuesday, Chaotic Eclipse now claims the vulnerability can nonetheless be exploited.
BleepingComputer contacted Microsoft about this extra zero-day and can replace this story if we obtain a response.
Researcher behind the current string of Home windows zero-days
MiniPlasma is the newest in a string of Home windows zero-day disclosures revealed by the researcher over the previous a number of weeks.
The disclosure spree started in April with BlueHammer, a Home windows native privilege escalation flaw tracked as CVE-2026-33825, adopted by one other privilege escalation vulnerability, RedSun, and a Home windows Defender DoS software, UnDefend.
After their disclosure, all three vulnerabilities have been noticed being exploited in assaults. In keeping with the researcher, Microsoft silently patched the RedSun challenge with out assigning it a CVE identifier.
This month, the researcher additionally launched two further exploits named YellowKey and GreenPlasma.
YellowKey is a BitLocker bypass affecting Home windows 11 and Home windows Server 2022/2025 that spawns a command shell that offers entry to unlocked drives protected by TPM-only BitLocker configurations.
Chaotic Eclipse has beforehand said that they’re publicly disclosing these Home windows zero-days in protest of Microsoft’s bug bounty and vulnerability-handling course of.
“Usually, I might undergo the method of begging them to repair a bug however to summarize, I used to be advised personally by them that they are going to damage my life they usually did and I am unsure if I used to be the one who had this horride expertise or few folks did however I believe most would simply eat it and lower their losses however for me, they took away the whole lot,” alleged the researcher.
“They mopped the ground with me and pulled each infantile sport they might. It was soo unhealthy in some unspecified time in the future I used to be questioning if I used to be coping with a large company or somebody who’s simply having enjoyable seeing me endure however it appears to be a collective choice.”
Microsoft beforehand advised BleepingComputer that it helps coordinated vulnerability disclosure and is dedicated to investigating reported security points and defending clients by updates.
Automated pentesting instruments ship actual worth, however they have been constructed to reply one query: can an attacker transfer by the community? They weren’t constructed to check whether or not your controls block threats, your detection guidelines fireplace, or your cloud configs maintain.
This information covers the 6 surfaces you truly have to validate.
Obtain Now
