A cybersecurity researcher has released a proof-of-concept exploit for a Windows privilege escalation zero-day dubbed "MiniPlasma" that lets attackers gain SYSTEM privileges on fully patched Windows systems. 

View post on Reddit.

A cybersecurity researcher has released a proof-of-concept exploit for a Windows privilege escalation zero-day dubbed "MiniPlasma" that lets attackers gain SYSTEM privileges on fully patched Windows s...

CVE-2020-17103 was apparently not patched or the patch was reversed, regardless this the PoC for an LPE in cldflt.sys - Nightmare-Eclipse/MiniPlasma

Der IT-Forscher hinter dem „NightmareEclipse“-Projekt zeigt neue Lücken: „YellowKey“ in BitLocker und Rechteausweitung mit „MiniPlasma“.

Microsoft just patched YellowKey, GreenPlasma, and MiniPlasma as part of its June 2026 Patch Tuesday update.

On Tuesday, Microsoft patched two zero-day vulnerabilities that let attackers gain SYSTEM privileges on fully patched Windows systems, and a third one that grants access to BitLocker-protected drives.

For some wild reason, Tenable decided to run a recent PoC as part of their vulnerability scanning, generating thousands of alerts across customer EDRs this last Memorial Day weekend. CrowdStrike Support Notice (Login required) https://supportportal.crowdstrike.com/s/article/Tech-Alert-US-1-US-2-EU-1-MiniPlasma-Detection-2026-05-25

A cybersecurity researcher has released a proof-of-concept exploit for a Windows privilege escalation zero-day dubbed "MiniPlasma" that lets attackers gain SYSTEM privileges on fully patched Windows systems.  [...]

A critical Windows privilege escalation zero-day vulnerability dubbed “MiniPlasma” has emerged with a public proof-of-concept exploit that allows attackers to achieve SYSTEM-level privileges on fully patched Windows systems. Security researcher Nightmare-Eclipse released the weaponized exploit on GitHub on May 13, 2026, claiming that Microsoft either failed to patch or silently rolled back the fix for a vulnerability originally reported six years ago. The flaw targets the cldflt.sys Cloud Filter driver’s HsmOsBlockPlaceholderAccess routine, which was initially discovered and reported to Microsoft by Google Project Zero researcher James Forshaw in September 2020. Microsoft assigned CVE-2020-17103 to the vulnerability and reportedly fixed it in December 2020 as part of its Patch Tuesday updates. However, Nightmare-Eclipse discovered that the same issue documented in Forshaw’s original report remains exploitable without any modifications to the original proof-of-concept code. The researcher released MiniPlasma one day after Microsoft’s May 2026 Patch Tuesday , timing the disclosure to follow the patch cycle and leaving organizations without an official fix until at least the next scheduled update. The exploit has gained significant attention in the security community, with the GitHub repository accumulating over 390 stars within days of publication. MiniPlasma Zero-Day PoC Released The vulnerability allows unprivileged users to create arbitrary registry keys.DEFAULT user hive without proper access checks. According to Google Project Zero , the flaw lies in how the HsmOsBlockPlaceholderAccess function handles registry key creation, failing to specify the OBJ_FORCE_ACCESS_CHECK flag. This enables attackers to bypass normal access restrictions and write keys to the.DEFAULT user hive, even though standard users typically lack such permissions. The exploit weaponizes this behavior by exploiting a race condition that toggles between user and anonymous tokens to manipulate the RtlOpenCurrentUser function in the kernel. When the race condition succeeds, the system opens the.DEFAULT hive for writing while the thread impersonation is reverted, allowing unauthorized key creation. Nightmare-Eclipse’s proof-of-concept, published on GitHub , demonstrates reliable exploitation on multi-core systems by spawning a SYSTEM shell after successfully winning the race condition. The vulnerability affects all Windows versions, making it a significant threat to enterprise environments, workstations, and cloud-synchronized systems. Testing confirmed that running the exploit from a standard user account successfully opens a command prompt with SYSTEM privileges, granting attackers complete control over the compromised machine. The Cloud Filter driver component is integral to Windows cloud storage synchronization services like OneDrive , meaning the vulnerable code runs on a broad range of Windows installations. Organizations should monitor Microsoft’s security response and prepare to deploy patches as soon as they become available, as the public availability of working exploit code significantly increases the risk of exploitation. Follow us on  Google News ,  LinkedIn , and  X  to Get More Instant Updates. The post New Windows ‘MiniPlasma’ Zero-Day Let Attackers Gain SYSTEM Access – PoC Released appeared first on Cyber Security News .

A cybersecurity researcher has released a proof-of-concept exploit for a Windows privilege escalation zero-day dubbed

YellowKey, GreenPlasma, and MiniPlasma add to the growing list of vulnerabilities a security researcher disclosed over the past six weeks.

A cybersecurity researcher has released a proof-of-concept exploit for a Windows privilege escalation zero-day dubbed "MiniPlasma" that lets attackers gain SYSTEM privileges on fully patched Windows systems.

On Tuesday, Microsoft patched two zero-day vulnerabilities that let attackers gain SYSTEM privileges on fully patched Windows systems, and a third one that grants access to BitLocker-protected drives.

Ein aktueller Proof-of-Concept für MiniPlasma, einen Zero-Day-Treiber im Windows Cloud Filter, erlaubt es Standardnutzern, auf vollständig gepatchten Windows 11-Systemen SYSTEM-Berechtigungen zu erlangen.

MiniPlasma: a Windows SYSTEM privilege escalation believed patched in 2020 (CVE-2020-17103) is still fully working on every patched Windows 11. Once again, security researcher Chaotic Eclipse has released a proof-of-concept exploit for a new Windows privilege escalation zero-day called MiniPlasma, which can grant attackers SYSTEM privileges on fully patched systems. The flaw affects “cldflt.sys,” the […]

A cybersecurity researcher has released a proof-of-concept exploit for a Windows privilege escalation zero-day dubbed

A cybersecurity researcher has released a proof-of-concept exploit for a Windows privilege escalation zero-day dubbed