On May 13, 2026, a researcher under the pseudonym Nightmare-Eclipse posted a working service of MiniPlasma on GitHub. The shaft lifts a regular user to NT AUTHORITY\SYSTEM on Windows 11 with installed updates to the May 2026 Patch Tuesday. It would seem - CVE-2020-17103 in the driver cldflt.sys found James Forshaw from the Google Project Zero back in September 2020, the patch rolled out in December. Six years have passed. And the original PoC worked without a single revision. Just launched - and received SYSTEM.
EPSS Rating CVE-2020-17103 - 0.2722 (97th percent), top 5% for use within 30 days. MiniPlasma is the sixth Chaotic Eclipse series in six weeks, and the three previous ones in this series are confirmed in real attacks. Not in the laba, on sale.
Increased privileges through cldflt.sys: a place in the attack chain
MiniPlasma is a local exploit. Initial access does not give. But let’s be honest: in the real world (phishing, macro document, drive-by download, stolen RDP-creds) the attacker receives foothold in the form of a low-priv session. And it is at the stage of transition from a limited user to full control of the LPE host to SYSTEM that the attacker remains in the sandbox or picks up the car as a whole.
What gives LPE to SYSTEM via cldflt.sys in the context of kill chain:
• Credential access - LSASS dump, NTLM hashes and Kerberos-tickets for piercing
• Defense evasion - disabling or blinding EDR-agents working in user-mode (more on how it is done without third-party tools - LOLBAS manual and bypass EDR)
• Persistence - a record in protected ledgers (SYSTEM, SAM, SECURITY), creation of services
• Lateral movement - the use of extracted tickets to move over the network
For ransomware operators, public LPE zero-day with a working PoC is a force multiplier. The most unreliable stage (an escalation of low-priv foothold before the control of the machine) becomes trivial. According to ThreatLocker, BlueHammer, RedSun and UnDefend - previous exploits of the Chaotic Eclipse series - have already been confirmed in real attacks after public disclosure.
MITRE ATT&CK: T1068 - Exploitation for Privilege Escalation (Tactic: Privilege Escalation)
Windows Cloud Files Mini Filter Driver: Driver with a History of Returning LPE-Vulnerabilities
cldflt.sys is a kernel-mode minifilter that handles placeholder operations in OneDrive and other cloud providers. When a user opens the file from the cloud, cldflt.sys intercepts the query via FltRegisterFilter, initiates hydration (downloading of contents) and manages the life cycle placeholder.
And now - the most interesting. cldflt.sys is loaded by default on most Windows 11 installations due to the integration of OneDrive. kernel mode driver with SYSTEM privileges, available for interaction from userland through Cloud Files API - CfRegisterSyncRoot, CfConnectSyncRoot, CfAbortHydration. A weakly documented interface through which the userland process can pull the kernel-mode component. Sounds like an invitation.
Three vulnerabilities, one driver, different primitives. This is a pattern characteristic of kernel-mode components with high code complexity and leaky coverage in security review. If you are engaged in kernel research - cldflt.sys should be kept on a watchlist: each patch of one baga potentially regression in adjacent code paths.
CVE-2020-17103: race condition and MiniPlasma exploit chain
CVE-2020-17103 - Elevation of Privilege in cldflt.sys with CVSS 7.0 (HIGH), CVSS:3.1/AV/AC:L/AX:H/L:UI/C/C/H/H/A:H/A:H.:H/H. We will understand the parts: AC:H (Attack Complexity: High) - race condition, you need to get into the temporary window. PR:L (Privileges Required: Low) is enough for the average user. UI:N - the victim does not need to press anything.
CWE-269 (Improper Privilege Management) describes the root of the problem: routine HsmOsBlockPlaceholderAccess inside cldflt.sys does not check the rights when processing placesholder-related files related to OneDrive. Through the API CfAbortHydration attacker forces the driver to create arbitrary registry keys in hive .DEFAULT.
Why .DEFAULT = SYSTEM? The bush HKU\.DEFAULT In Windows, it is mapped to the context of the SYSTEM account. Recording arbitrary keys in this hive allows you to influence the behavior of processes working on behalf of SYSTEM - from the environment variables (Volatile Environment) before the DLL loading policy.
MiniPlasma operation chain:
1. The exploit is launched on behalf of the standard user
2. Registers sync root via the Cloud Files API (CfRegisterSyncRoot, CfConnectSyncRoot)
3. Creates a placeholder file in a controlled directory
4. Causes CfAbortHydrationwith parameters that trigger HsmOsBlockPlaceholderAccess
5. Two streams simultaneously manipulate the state of placeholder and registry keys - race condition
6. At the moment when the check of the rights is passed, but the recording has not yet been completed, the second stream replaces the target route for .DEFAULT
7. Driver records the key in .DEFAULThive with privileges of SYSTEM
8. Through manipulation Volatile Environmentor CloudFiles\BlockedApps- escalation to SYSTEM shell
Original PoC Forkshaw (PoC_AbortHydration_ArbitraryRegKey_EoP) worked on the current Windows 11 builds without modifications. MiniPlasma - a weaponized version of the same PoC, modified to generate SYSTEM shell. Repportendary CaptainChicky/MiniPlasma on GitHub (updated 2026-06-01).
According to Fyntralink and ThreatLocker, BleepingComputer independently confirmed that after the launch of the MiniPlasma on the name of the standard user on the fully updated Windows 11 Pro, command prompts with the privileges of SYSTEM. No UAC bypass, without additional exploits. Will Dormann, principal vulnerability in Tharros, confirmed the operability on Windows 11 including 26H1.
Predictions and limitations of technology
Works if:
• Windows 11 (22H2, 23H2, 26H1) with updates including May 2026 Patch Tuesday
• Windows Server 2022, Windows Server 2025 (according to Rescana)
• Cldflt.sys driver loaded (default if OneDrives are available)
• The attacker has local execution of the code on behalf of the low-priv user
Does not work if:
• Windows 11 Insider Preview Canary builds - according to Will Dormann, the exploit does not work on Canary builds, which indicates the presence of a fix in the preview branch
• Windows 10 - ThreatLocker did not confirm the vulnerability on Windows 10 (although the NVD indicates Windows 10 in impact for CVE-2020-17103; MiniPlasma was tested mainly on Windows 11)
• cldflt.sys disconnected or unloaded (service cldfltin Disabled)
• Application allowlisting (WDAC/AppLocker) blocks the start - the exploit does not reach a vulnerable code
Race condition = unstable reliability. It's a race between streams. On the loaded system, the time window narrows, the idle expands. The success rate depends on the configuration of the specific host. ThreatLocker confirms the performance, but it is not "pressed the button - received SYSTEM" on each machine. Sometimes you need a few attempts, sometimes a dozen.
Family of LPE-Vulnerabilities: CVE-2025-62221 and BlueHammer
CVE-2025-62221: use-after-free in the same driver
Six months before MiniPlasma, in December 2025, Microsoft was injected CVE-2025-62221 - use-after-free (CWE-416) in Windows Cloud Files Mini Filter Driver. CVSS 7.8 (HIGH), CVSS vector:3.1/AV:L/AC:L/L:L/L:L/UI::H/H/A:H/H. Note: AC:L (LW Complexity) - unlike race condition CVE-2020-17103, UAF-primitive is very easy to operate.
CVE-2025-62221 added to CISA KEV on December 9, 2025 with a patch deadline on December 30. CISA SSVC Decision: Act - put it right now. Exploitation status: active. Affected products: Windows 10 1809, Windows 10 21H2, Windows 10 22H2, Windows 11 23H2. KB-articles: KB5071547, KB5071414, KB50715444
Two different classes of Windows kernel (race condition vs use-after-free) in one driver with an interval of five years. For those who dig Windows kernel driver, this is a signal: cldflt.sys - a component with heavy IRP handlers and clearly insufficient fuzzing coverage.
BlueHammer: Cloud Files API as design flaw
On April 3, 2026, Chaotic Eclipse published BlueHammer - Windows SYSTEM privilege escalation zero-day, which uses Cloud Files API in conjunction with Volume Shadow Copy Service and Microsoft Defender.
The BlueHammer vector is fundamentally different. This is not a bug in a specific routine cldflt.sys, but design flaw in the interaction of four legitimate components:
1. Defender update workflow creates a VSS image
2. Cloud Files callbacks (CfCallbackFetchPlaceHolders) give the attacker a programmable pause - callback does not return the response until the attacker allows
3. Opportunistic locks (oplocks) keeps Defender in a blocked state
4. VSS-snilee remains mounted - SAM, SYSTEM, SECURITY hives available for reading
According to Cyderes (Howler Cell), BlueHammer is played end-to-end on Windows 10 and 11 - low-priv-wmail receives SYSTEM in less than a minute. Defender detects the original PoC as Exploit:Win32/DfndrPEBluHmr.BB, but once the vulnerability in the interaction of components, the modification of the implementation bypasses the signature.
Regression of Windows kernel patches: why old bugs come back
MiniPlasma is a clear demonstration of what patch regression is in practice. Patch for CVE-2020-17103 released in December 2020 (KB4592438, KB4594249 according to MSRC). The organization noted CVE as remediated in the vulnerability management platforms. Compliance reports were shown in closed find. Six years and vulnerability is exploited again.
Two scenarios, both are discussed by researchers:
1. Incomplete patch. The correction closed a specific code path, but did not eliminate the root cause - the lack of verification of rights in HsmOsBlockPlaceholderAccess. Refactoring the driver in subsequent builds could rediscover the vulnerable path.
2. Recoil with cuulative update. In the process of accumulative updates, Microsoft could unintentionally roll back the changes. For kernel-mode components with incomplete regression test coverage - a real story.
The conclusion for the pentester and the vulnerability researcher is the same: KB-based scanning does not guarantee remediation. Cumultative update status and CVE status in the scanner is not proof of a lack of vulnerability. Validation is required through a check of a specific exploit path. The scanner says "closed" - and PoC works six years ago.
The fact that Insider Preview Canary builds is not vulnerable confirms that Microsoft is aware of the problem and has included a fix in the preview branch. But at the time of publication, MiniPlasma (May 2026) production releases remained vulnerable. Microsoft said it was “investigating the report and taking action to protect customers” – a standard wording without the appointment of a new CVE and without an emergency patch.
Detection MiniPlasma: registry-monitoring and behavioral indicators
MiniPlasma leaves specific traces. According to ThreatLocker, the exploit is manipulated by two registry branches:
Code:
\Registry\User\Software\Policies\Microsoft\CloudFiles\BlockedApps*
\Registry\User\.DEFAULT\Volatile Environment*
Recording in any of these branches from the non-SYSTEM process is a strong indicator of the operation of the MiniPlasma or similar LPE technician via cldflt.sys.
For SIEM: Set up alertas at Event ID 4657 (Registry Value Modified, with Object Access Auditing) HKU\.DEFAULT processes that are not under SYSTEM. Monitoring the creation cmd.exe / powershell.exe with the privileges of SYSTEM from the context of the standard user (Event ID 4688 with TokenElevationType = Full Token).
ThreatLocker has published Community Policy TL.REG.1747 for detecting the creation of a retread key MiniPlasma with a mapping on MITRE ATT&CK TA0004 (Privilege Escalation).
For EDR: Confirm the vendor's presence of detection content for cldflt.sys abuse patterns. For Microsoft Defender for Endpoint, CrowdStrike Falcon and SentinelOne - request detection support status CfAbortHydration of unprivileged contexts. If the vendor has not yet issued the rules - write custom detections to registry in .DEFAULT Processes that are not Windows services.
Limitation: Registror monitoring - reactive detection. He fixes the fact of exploitation, but does not prevent it. The only proactive measure before the patch is to block the launch of unauthorized executable executable files through the WDAC or AppLocker (default-deny policy). ThreatLocker confirmed that with the default-deny payload policy, it is blocked until a vulnerable code is reached.
EPSS Rating CVE-2020-17103 - 0.2722 (97th percent), top 5% for use within 30 days. MiniPlasma is the sixth Chaotic Eclipse series in six weeks, and the three previous ones in this series are confirmed in real attacks. Not in the laba, on sale.
Increased privileges through cldflt.sys: a place in the attack chain
MiniPlasma is a local exploit. Initial access does not give. But let’s be honest: in the real world (phishing, macro document, drive-by download, stolen RDP-creds) the attacker receives foothold in the form of a low-priv session. And it is at the stage of transition from a limited user to full control of the LPE host to SYSTEM that the attacker remains in the sandbox or picks up the car as a whole.
What gives LPE to SYSTEM via cldflt.sys in the context of kill chain:
• Credential access - LSASS dump, NTLM hashes and Kerberos-tickets for piercing
• Defense evasion - disabling or blinding EDR-agents working in user-mode (more on how it is done without third-party tools - LOLBAS manual and bypass EDR)
• Persistence - a record in protected ledgers (SYSTEM, SAM, SECURITY), creation of services
• Lateral movement - the use of extracted tickets to move over the network
For ransomware operators, public LPE zero-day with a working PoC is a force multiplier. The most unreliable stage (an escalation of low-priv foothold before the control of the machine) becomes trivial. According to ThreatLocker, BlueHammer, RedSun and UnDefend - previous exploits of the Chaotic Eclipse series - have already been confirmed in real attacks after public disclosure.
MITRE ATT&CK: T1068 - Exploitation for Privilege Escalation (Tactic: Privilege Escalation)
Windows Cloud Files Mini Filter Driver: Driver with a History of Returning LPE-Vulnerabilities
cldflt.sys is a kernel-mode minifilter that handles placeholder operations in OneDrive and other cloud providers. When a user opens the file from the cloud, cldflt.sys intercepts the query via FltRegisterFilter, initiates hydration (downloading of contents) and manages the life cycle placeholder.
And now - the most interesting. cldflt.sys is loaded by default on most Windows 11 installations due to the integration of OneDrive. kernel mode driver with SYSTEM privileges, available for interaction from userland through Cloud Files API - CfRegisterSyncRoot, CfConnectSyncRoot, CfAbortHydration. A weakly documented interface through which the userland process can pull the kernel-mode component. Sounds like an invitation.
Three vulnerabilities, one driver, different primitives. This is a pattern characteristic of kernel-mode components with high code complexity and leaky coverage in security review. If you are engaged in kernel research - cldflt.sys should be kept on a watchlist: each patch of one baga potentially regression in adjacent code paths.
CVE-2020-17103: race condition and MiniPlasma exploit chain
CVE-2020-17103 - Elevation of Privilege in cldflt.sys with CVSS 7.0 (HIGH), CVSS:3.1/AV/AC:L/AX:H/L:UI/C/C/H/H/A:H/A:H.:H/H. We will understand the parts: AC:H (Attack Complexity: High) - race condition, you need to get into the temporary window. PR:L (Privileges Required: Low) is enough for the average user. UI:N - the victim does not need to press anything.
CWE-269 (Improper Privilege Management) describes the root of the problem: routine HsmOsBlockPlaceholderAccess inside cldflt.sys does not check the rights when processing placesholder-related files related to OneDrive. Through the API CfAbortHydration attacker forces the driver to create arbitrary registry keys in hive .DEFAULT.
Why .DEFAULT = SYSTEM? The bush HKU\.DEFAULT In Windows, it is mapped to the context of the SYSTEM account. Recording arbitrary keys in this hive allows you to influence the behavior of processes working on behalf of SYSTEM - from the environment variables (Volatile Environment) before the DLL loading policy.
MiniPlasma operation chain:
1. The exploit is launched on behalf of the standard user
2. Registers sync root via the Cloud Files API (CfRegisterSyncRoot, CfConnectSyncRoot)
3. Creates a placeholder file in a controlled directory
4. Causes CfAbortHydrationwith parameters that trigger HsmOsBlockPlaceholderAccess
5. Two streams simultaneously manipulate the state of placeholder and registry keys - race condition
6. At the moment when the check of the rights is passed, but the recording has not yet been completed, the second stream replaces the target route for .DEFAULT
7. Driver records the key in .DEFAULThive with privileges of SYSTEM
8. Through manipulation Volatile Environmentor CloudFiles\BlockedApps- escalation to SYSTEM shell
Original PoC Forkshaw (PoC_AbortHydration_ArbitraryRegKey_EoP) worked on the current Windows 11 builds without modifications. MiniPlasma - a weaponized version of the same PoC, modified to generate SYSTEM shell. Repportendary CaptainChicky/MiniPlasma on GitHub (updated 2026-06-01).
According to Fyntralink and ThreatLocker, BleepingComputer independently confirmed that after the launch of the MiniPlasma on the name of the standard user on the fully updated Windows 11 Pro, command prompts with the privileges of SYSTEM. No UAC bypass, without additional exploits. Will Dormann, principal vulnerability in Tharros, confirmed the operability on Windows 11 including 26H1.
Predictions and limitations of technology
Works if:
• Windows 11 (22H2, 23H2, 26H1) with updates including May 2026 Patch Tuesday
• Windows Server 2022, Windows Server 2025 (according to Rescana)
• Cldflt.sys driver loaded (default if OneDrives are available)
• The attacker has local execution of the code on behalf of the low-priv user
Does not work if:
• Windows 11 Insider Preview Canary builds - according to Will Dormann, the exploit does not work on Canary builds, which indicates the presence of a fix in the preview branch
• Windows 10 - ThreatLocker did not confirm the vulnerability on Windows 10 (although the NVD indicates Windows 10 in impact for CVE-2020-17103; MiniPlasma was tested mainly on Windows 11)
• cldflt.sys disconnected or unloaded (service cldfltin Disabled)
• Application allowlisting (WDAC/AppLocker) blocks the start - the exploit does not reach a vulnerable code
Race condition = unstable reliability. It's a race between streams. On the loaded system, the time window narrows, the idle expands. The success rate depends on the configuration of the specific host. ThreatLocker confirms the performance, but it is not "pressed the button - received SYSTEM" on each machine. Sometimes you need a few attempts, sometimes a dozen.
Family of LPE-Vulnerabilities: CVE-2025-62221 and BlueHammer
CVE-2025-62221: use-after-free in the same driver
Six months before MiniPlasma, in December 2025, Microsoft was injected CVE-2025-62221 - use-after-free (CWE-416) in Windows Cloud Files Mini Filter Driver. CVSS 7.8 (HIGH), CVSS vector:3.1/AV:L/AC:L/L:L/L:L/UI::H/H/A:H/H. Note: AC:L (LW Complexity) - unlike race condition CVE-2020-17103, UAF-primitive is very easy to operate.
CVE-2025-62221 added to CISA KEV on December 9, 2025 with a patch deadline on December 30. CISA SSVC Decision: Act - put it right now. Exploitation status: active. Affected products: Windows 10 1809, Windows 10 21H2, Windows 10 22H2, Windows 11 23H2. KB-articles: KB5071547, KB5071414, KB50715444
Two different classes of Windows kernel (race condition vs use-after-free) in one driver with an interval of five years. For those who dig Windows kernel driver, this is a signal: cldflt.sys - a component with heavy IRP handlers and clearly insufficient fuzzing coverage.
BlueHammer: Cloud Files API as design flaw
On April 3, 2026, Chaotic Eclipse published BlueHammer - Windows SYSTEM privilege escalation zero-day, which uses Cloud Files API in conjunction with Volume Shadow Copy Service and Microsoft Defender.
The BlueHammer vector is fundamentally different. This is not a bug in a specific routine cldflt.sys, but design flaw in the interaction of four legitimate components:
1. Defender update workflow creates a VSS image
2. Cloud Files callbacks (CfCallbackFetchPlaceHolders) give the attacker a programmable pause - callback does not return the response until the attacker allows
3. Opportunistic locks (oplocks) keeps Defender in a blocked state
4. VSS-snilee remains mounted - SAM, SYSTEM, SECURITY hives available for reading
According to Cyderes (Howler Cell), BlueHammer is played end-to-end on Windows 10 and 11 - low-priv-wmail receives SYSTEM in less than a minute. Defender detects the original PoC as Exploit:Win32/DfndrPEBluHmr.BB, but once the vulnerability in the interaction of components, the modification of the implementation bypasses the signature.
Regression of Windows kernel patches: why old bugs come back
MiniPlasma is a clear demonstration of what patch regression is in practice. Patch for CVE-2020-17103 released in December 2020 (KB4592438, KB4594249 according to MSRC). The organization noted CVE as remediated in the vulnerability management platforms. Compliance reports were shown in closed find. Six years and vulnerability is exploited again.
Two scenarios, both are discussed by researchers:
1. Incomplete patch. The correction closed a specific code path, but did not eliminate the root cause - the lack of verification of rights in HsmOsBlockPlaceholderAccess. Refactoring the driver in subsequent builds could rediscover the vulnerable path.
2. Recoil with cuulative update. In the process of accumulative updates, Microsoft could unintentionally roll back the changes. For kernel-mode components with incomplete regression test coverage - a real story.
The conclusion for the pentester and the vulnerability researcher is the same: KB-based scanning does not guarantee remediation. Cumultative update status and CVE status in the scanner is not proof of a lack of vulnerability. Validation is required through a check of a specific exploit path. The scanner says "closed" - and PoC works six years ago.
The fact that Insider Preview Canary builds is not vulnerable confirms that Microsoft is aware of the problem and has included a fix in the preview branch. But at the time of publication, MiniPlasma (May 2026) production releases remained vulnerable. Microsoft said it was “investigating the report and taking action to protect customers” – a standard wording without the appointment of a new CVE and without an emergency patch.
Detection MiniPlasma: registry-monitoring and behavioral indicators
MiniPlasma leaves specific traces. According to ThreatLocker, the exploit is manipulated by two registry branches:
Code:
\Registry\User\Software\Policies\Microsoft\CloudFiles\BlockedApps*
\Registry\User\.DEFAULT\Volatile Environment*
Recording in any of these branches from the non-SYSTEM process is a strong indicator of the operation of the MiniPlasma or similar LPE technician via cldflt.sys.
For SIEM: Set up alertas at Event ID 4657 (Registry Value Modified, with Object Access Auditing) HKU\.DEFAULT processes that are not under SYSTEM. Monitoring the creation cmd.exe / powershell.exe with the privileges of SYSTEM from the context of the standard user (Event ID 4688 with TokenElevationType = Full Token).
ThreatLocker has published Community Policy TL.REG.1747 for detecting the creation of a retread key MiniPlasma with a mapping on MITRE ATT&CK TA0004 (Privilege Escalation).
For EDR: Confirm the vendor's presence of detection content for cldflt.sys abuse patterns. For Microsoft Defender for Endpoint, CrowdStrike Falcon and SentinelOne - request detection support status CfAbortHydration of unprivileged contexts. If the vendor has not yet issued the rules - write custom detections to registry in .DEFAULT Processes that are not Windows services.
Limitation: Registror monitoring - reactive detection. He fixes the fact of exploitation, but does not prevent it. The only proactive measure before the patch is to block the launch of unauthorized executable executable files through the WDAC or AppLocker (default-deny policy). ThreatLocker confirmed that with the default-deny payload policy, it is blocked until a vulnerable code is reached.
