Critical MiniPlasma Zero-Day Vulnerability in Windows Lets Attackers Gain SYSTEM Access

Key Takeaways

• A critical zero-day vulnerability, dubbed “MiniPlasma,” has emerged in Windows, allowing attackers to escalate privileges to SYSTEM level.
• The flaw, impacting the cldflt.sys Cloud Filter driver, was previously reported and supposedly patched by Microsoft in 2020 (CVE-2020-17103), but a security researcher found it remains exploitable.
• A public proof-of-concept (PoC) exploit is available on GitHub, demonstrating reliable SYSTEM access on fully patched Windows systems.
• All Windows versions are affected, and no official patch is currently available, leaving systems vulnerable to immediate exploitation.

Critical Windows Zero-Day “MiniPlasma” Unleashes SYSTEM-Level Access

A severe zero-day vulnerability in Microsoft Windows, publicly identified as “MiniPlasma,” has been revealed, providing attackers with a straightforward path to achieve SYSTEM-level privileges on fully updated Windows installations. A working proof-of-concept (PoC) exploit for this privilege escalation flaw is now openly accessible, raising urgent concerns across the cybersecurity landscape.

The exploit’s release by security researcher Nightmare-Eclipse on GitHub on May 13, 2026, coincided with claims that Microsoft had either failed to adequately address or had silently reverted a fix for an issue first reported six years prior. This timing, intentionally following Microsoft’s May 2026 Patch Tuesday, means organizations are left exposed without an immediate official remedy.

Re-Emergence of a Previously Patched Flaw

The vulnerability targets the HsmOsBlockPlaceholderAccess routine within the cldflt.sys Cloud Filter driver. This specific flaw was originally discovered and reported to Microsoft in September 2020 by Google Project Zero researcher James Forshaw. Microsoft subsequently assigned CVE-2020-17103 to the issue and reportedly released a fix as part of its December 2020 Patch Tuesday updates.

However, Nightmare-Eclipse’s independent research uncovered that the vulnerability described in Forshaw’s initial report remains exploitable, requiring no modifications to the original PoC code. The public release of the MiniPlasma exploit has rapidly garnered significant attention, with its GitHub repository quickly accumulating over 390 stars.

Technical Details of the MiniPlasma Exploit

The core of the “MiniPlasma” vulnerability resides in an improper access control mechanism that permits unprivileged users to create arbitrary registry keys within the .DEFAULT user hive. According to Google Project Zero’s findings, the HsmOsBlockPlaceholderAccess function fails to incorporate the OBJ_FORCE_ACCESS_CHECK flag when creating registry keys. This omission allows attackers to circumvent standard access restrictions, enabling writes to the .DEFAULT user hive—a privilege typically denied to standard users.

The exploit leverages this behavior by exploiting a race condition. It manipulates the RtlOpenCurrentUser function within the kernel, toggling between user and anonymous tokens. When this race condition is successfully won, the system opens the .DEFAULT hive for writing while the thread impersonation is temporarily reverted, thereby facilitating unauthorized key creation. Nightmare-Eclipse’s proof-of-concept on GitHub reliably demonstrates this, culminating in the spawning of a SYSTEM shell on multi-core systems after the race condition is met.

The vulnerability’s broad impact extends to all Windows versions, posing a substantial threat to enterprise environments, individual workstations, and systems utilizing cloud synchronization services. Tests confirm that executing the exploit from a standard user account successfully yields a command prompt with SYSTEM privileges, granting complete control over the compromised machine. Given that the Cloud Filter driver is fundamental to Windows cloud storage synchronization services like OneDrive, the vulnerable code is present across a vast array of Windows installations.

What You Should Do

• Monitor for Official Patches: Immediately prepare to deploy any security updates released by Microsoft to address CVE-2020-17103 or a new CVE for this re-emerged vulnerability.
• Implement Principle of Least Privilege: Ensure all users operate with the absolute minimum necessary privileges to perform their tasks. This limits the impact of successful privilege escalation exploits.
• Enhance Endpoint Detection and Response (EDR): Utilize EDR solutions to monitor for unusual process activity, especially any attempts by non-SYSTEM accounts to modify critical system components or spawn shells with elevated privileges.
• Review System Hardening: Regularly review and apply system hardening best practices to reduce the overall attack surface and mitigate the impact of potential exploits.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.