New Windows 'MiniPlasma' zero-day exploit gives SYSTEM access, PoC released

# Windows 'MiniPlasma' Zero-Day Gives Attackers SYSTEM Access — Microsoft's December 2020 Patch Fails to Fix

A cybersecurity researcher has publicly released a working exploit for a Windows privilege escalation vulnerability that Microsoft claimed to have patched nearly six years ago. The exploit, dubbed MiniPlasma, allows attackers to escalate from standard user privileges to SYSTEM access on fully patched Windows 11 systems, and proof-of-concept code is already available on GitHub alongside compiled executables ready for immediate deployment.

## The Threat

MiniPlasma is an actively exploitable privilege escalation vulnerability affecting:

The exploit abuses undocumented APIs in the Windows Cloud Filter driver to create arbitrary registry keys without proper access controls. When executed by a standard user account, it opens a command prompt with full SYSTEM privileges—the highest privilege level on Windows. Independent security researchers have confirmed the exploit works in real-world testing.

What makes this critical:

## Background and Context

The vulnerability at the heart of MiniPlasma is not new. Google Project Zero researcher James Forshaw originally reported a flaw in the Cloud Filter driver's HsmOsBlockPlaceholderAccess routine to Microsoft in September 2020. Microsoft assigned it CVE-2020-17103 and announced a fix in December 2020.

However, security researcher Chaotic Eclipse (also known as Nightmare Eclipse) claims that the vulnerability was never properly patched. "After investigating, it turns out the exact same issue that was reported to Microsoft by Google project zero is actually still present, unpatched," the researcher stated. "I'm unsure if Microsoft just never patched the issue or the patch was silently rolled back at some point for unknown reasons. The original PoC by Google worked without any changes."

This disclosure is part of an escalating public confrontation between the researcher and Microsoft. Over the past six weeks, Chaotic Eclipse has released at least five Windows zero-day exploits, including:

| Exploit | Type | CVE/Status | Impact |

|---------|------|-----------|--------|

| BlueHammer | Local privilege escalation | CVE-2026-33825 | SYSTEM access |

| RedSun | Privilege escalation | No CVE assigned (silently patched) | Elevated privileges |

| UnDefend | Denial of Service | Windows Defender crash | Disables antivirus |

| YellowKey | BitLocker bypass | Windows 11/Server 2022, 2025 | Access to TPM-encrypted drives |

| GreenPlasma | Privilege escalation | Recently disclosed | SYSTEM access |

According to the researcher's statements, all three of the initially disclosed vulnerabilities (BlueHammer, RedSun, UnDefend) were subsequently spotted in active exploitation campaigns in the wild.

## Technical Details

### How MiniPlasma Works

The exploit chain targets the CfAbortHydration API in the Cloud Filter driver, an undocumented interface used by Windows for cloud-based file synchronization and backup features. The attack vector works as follows:

1. Registry key manipulation: The Cloud Filter driver handles registry operations in the .DEFAULT user hive without properly validating access permissions

2. Privilege context confusion: By crafting specific registry operations, the exploit tricks the driver into executing commands under SYSTEM context

3. Command execution: Once elevated, the attacker has unrestricted access to the entire system

### Why the Original Patch Failed

The exact mechanism of the patch failure remains unclear. Possibilities include:

Notably, the exploit does not work on the latest Windows 11 Insider Preview Canary build, suggesting Microsoft has addressed the issue in development versions—but these fixes have not yet reached the public.

## Implications for Organizations

### Immediate Risk

### Affected Systems

### Detection Challenges

Organizations relying on endpoint detection to catch exploitation may struggle, as the attack uses legitimate Windows driver APIs. Log detection should focus on:

## Recommendations

### For Windows Administrators

1. Monitor for indicators of exploitation immediately—do not wait for a patch before implementing detection

2. Restrict standard user privileges where possible; require elevation for administrative tasks

3. Isolate vulnerable systems from networks if immediate patching is not possible

4. Test patches in non-production environments before deployment to catch any regressions

5. Review logs for suspicious Cloud Filter driver activity over the past 30 days to identify if exploitation has already occurred

### For Microsoft

The company faces mounting pressure to:

---

## HackWire Analysis

The MiniPlasma disclosure exposes a fundamental credibility crisis at Microsoft. If a vulnerability is claimed to be patched but remains exploitable six years later, either Microsoft's patching process is broken, its testing is inadequate, or its communication about fixes is misleading. None of these scenarios inspire confidence.

What's particularly alarming is the *pattern*. Chaotic Eclipse has now released five Windows zero-days in rapid succession, all have proven exploitable in production, and all appear to stem from either genuine oversights in patch quality or a systemic failure to properly validate fixes. This isn't a single researcher finding edge cases—this is evidence of a breakdown in Microsoft's vulnerability response chain.

The release of compiled executables on GitHub is also significant. Responsible disclosure typically means the vendor gets time to patch before public PoC availability. However, when a patch supposedly shipped six years ago but fails to actually patch the vulnerability, the researcher's decision to publish becomes understandable as an escalation tactic. This creates a dangerous precedent: researchers who lose faith in vendor patch quality have less incentive to follow disclosure protocols.

For defenders, the immediate lesson is simple: do not assume patches actually patch. Test them. Verify them. Treat a CVE fix with the same skepticism you'd apply to a new vulnerability disclosure. The gap between Insider Canary builds (where the fix exists) and public builds (where it doesn't) also suggests Microsoft knows how to fix this but hasn't delivered the fix to the billion Windows users currently at risk.

This incident should accelerate conversations about Microsoft's bug bounty program and whether it adequately incentivizes responsible disclosure. If security researchers believe Microsoft ignores their reports, they will publish. And when they publish with ready-to-use exploits, defenders lose the advantage of a quiet patching window.

— HackWire Editorial

---

## Related Coverage