MiniPlasma Zero-Day Grants SYSTEM Privileges on Fully Patched Windows

A security researcher has published a working proof-of-concept exploit for a Windows privilege escalation zero-day that grants full SYSTEM-level access on fully patched Windows systems, including machines running the latest May 2026 updates.

The vulnerability, dubbed MiniPlasma by its discoverer, the researcher known as Chaotic Eclipse, affects the Windows Cloud Files Mini Filter Driver component, specifically a file called cldflt.sys, within a routine named HsmOsBlockPlaceholderAccess. The flaw was originally reported to Google Project Zero researcher James Forshaw in September 2020 and was believed to have been addressed as part of CVE-2020-17103 in December 2020.

A Patch That Never Was

Chaotic Eclipse's investigation has revealed that the underlying vulnerability remains present in current Windows builds. Either the patch was never fully applied, or it was silently rolled back at an undisclosed point. The researcher confirmed that the original Google Project Zero proof-of-concept code works against current Windows versions without modification. MiniPlasma builds on that foundation to spawn a SYSTEM shell, escalating privileges from a standard unprivileged user account.

"I'm unsure if Microsoft just never patched the issue or the patch was silently rolled back at some point for unknown reasons. The original PoC by Google worked without any changes," the researcher stated. "To highlight this issue, I weaponised the original PoC to spawn a SYSTEM shell. It seems to work reliably in my machines but success rate may vary since it's a race condition."

This is the third Windows vulnerability disclosed by Chaotic Eclipse in recent weeks, following YellowKey and GreenPlasma, both of which exposed BitLocker and kernel-level weaknesses.

Scope and Reliability

Security researcher Will Dormann independently confirmed that MiniPlasma functions reliably on Windows 11 systems running the latest May 2026 updates, producing a cmd.exe prompt with full SYSTEM privileges. Dormann noted the exploit does not appear to function on the latest Windows 11 Insider Preview Canary builds, which may indicate Microsoft has quietly addressed it in pre-release testing.

The vulnerability is a race condition, meaning success rates may vary across hardware configurations and system states, but testing indicates it works reliably on standard production systems. All current release versions of Windows are assessed as likely affected. Microsoft has not yet released a patch, and the exploit code is publicly available at the researcher's GitHub repository.

A Pattern of cldflt.sys Exposure

This is not the first time the Windows Cloud Files Mini Filter Driver has been found to carry exploitable privilege escalation flaws. Microsoft patched a separate elevation of privilege vulnerability in the same component, CVE-2025-62221 (CVSS 7.8), in December 2025, confirmed as having been exploited by unknown threat actors in the wild at the time of disclosure. The recurrence of exploitable issues in this specific component suggests it warrants closer and ongoing scrutiny from enterprise security teams.

Why This Matters for Enterprise Security Teams

Privilege escalation vulnerabilities of this kind are a critical component in multi-stage attacks. An attacker who has gained initial access through phishing, a supply chain compromise, or a stolen credential, all active threat patterns in the current GCC threat landscape, can use a local privilege escalation flaw to move from a limited user account to full system control. From that position, the attacker can disable endpoint protection, exfiltrate credentials stored on the device, and establish persistent access.

The fact that MiniPlasma targets a component introduced alongside cloud file sync features means it is present across virtually all modern Windows enterprise deployments. Organisations that rely on Windows-based developer workstations, CI/CD systems, or cloud-connected endpoints are particularly exposed.

Recommended Actions

No official patch is currently available. Until Microsoft releases a formal patch, enterprise security teams should monitor for any attempts to exploit race conditions in cldflt.sys, restrict local user privileges to the minimum necessary for job function, enforce application control policies that prevent unauthorised execution, and review endpoint detection rules for SYSTEM-level shell spawning from unexpected parent processes.

Organisations using ThreatLocker can apply Community Policy TL.REG.1747, published 18 May 2026, which detects the registry key creation associated with the MiniPlasma exploit chain and maps to MITRE ATT&CK TA0004 (Privilege Escalation).

Security teams should monitor the Microsoft Security Response Center and the CISA Known Exploited Vulnerabilities catalogue for updates. Organisations managing Windows estates across the Gulf should treat this as a priority item for their vulnerability management queues. Further context on endpoint privilege escalation risk is available via the UAE Cyber Security Council advisory portal. The next scheduled Patch Tuesday is 10 June 2026.