‘Patched’ Windows bug resurfaces 6 years later as working SYSTEM-level exploit

An old elevation-of-privilege (EoV) vulnerability affecting the Cloud Filter driver “cldflt.sys” in Windows has come back to haunt Microsoft, as researchers claim it is still exploitable six years after it was supposedly patched. The flaw, originally reported to Microsoft by Google Project Zero researcher James Forshaw in September 2020, was recently picked up by Nightmare Eclipse , a researcher on an ongoing spree of Windows bug discoveries, and reworked to gain SYSTEM privileges. “I’m unsure if Microsoft just never patched the issue or the patch was silently rolled back at some point for unknown reasons,” Eclipse said in a PoC writeup , calling the re-discovery ‘MiniPlasma’. “The original PoC by Google worked without any changes.” Eclipse’s PoC triggered SYSTEM privileges on all Windows versions running on the researcher’s machines, but said “success rate may vary since it’s a race condition.” “The exploit is highly credible, it works on fully patched systems, and it highlights a massive gap in how legacy regression flaws are managed,” said Agnidipta Sarkar, chief evangelist at ColorTokens. “A quick lookup tells me that the vulnerability resides in cldflt.sys (the Windows Cloud Files Mini Filter Driver), specifically within the HsmOsBlockPlaceholderAccess routine, which handles Cloud Sync functionality (such as OneDrive placeholder files).” Microsoft did not immediately respond to CSO’s request for comments. A fixed bug that still works MiniPlasma reproduced an old issue, tracked as CVE-2020-17103 , around how Windows handles key creation through an undocumented API tied to the Cloud Filter driver. Forshaw’s original Project Zero report described a scenario where arbitrary registry keys could be created inside the “.DEFAULT ” user hive without proper access checks, potentially enabling local privilege escalation . The flaw was assigned a 7.8 “high severity” CVSS rating by NIST, but Microsoft had contested that rating with a 7.0 out of 10 CVSS assessment of its own. “Because this is a Local Privilege Escalation (LPE) flaw, it cannot be used for initial, remote entry into a system,” Sarkar said. “And it is hopeful because this requires lateral movement, which can be denied by modern microsegmentation in an agentless model integrating with the EDR like CrowdStrike/Defender/SentinelOne, etc., implemented in less than a day to keep vulnerable systems quarantined until the Microsoft patch is applied.” Microsoft had patched the issue in December 2020, calling exploitation of the flaw “less likely” as it assessed the attack complexity to be “high.” Eclipse, however, claims the flawed behavior never truly disappeared. The original exploit chain from 2020 still succeeds on modern Windows builds, allowing a standard user account to elevate directly to SYSTEM privileges, they noted in the writeup. “I don’t know why Microsoft missed this, but my speculation is that either they blocked only a specific side channel, not the whole routine, or this was an accidental miss,” Sarkar added. “In either case, in the age of Mythos, this definitely is a major issue.” Security researcher Will Dormann confirmed the buggy behavior carried through to the latest May updates, though he noted the exploit failed on the latest Windows 11 Canary Insider build, suggesting Microsoft may already be quietly testing mitigations. It is unclear if the flaw was ever weaponized in these years, outside of the multiple POCs published. Nightmare-Eclipse’s Windows disclosure spree keeps growing MiniPlasma is only the latest entry in what has become one of 2026’s most chaotic Windows disclosure runs. The spree began with BlueHammer, a Windows Defender privilege escalation flaw later assigned CVE-2026-33825 . That was followed by RedSun and UnDefend, two additional Windows privilege escalation and denial-of-service disclosures. Huntress later reported observing BlueHammer, RedSun, and UnDefend tooling during a real-world intrusion investigation related to suspicious VPN activity and hands-on-keyboard attacker behavior. Earlier this month, Eclipse also released YellowKey and GreenPlasma. YellowKey allegedly bypasses TPM-only BitLocker protections by abusing Windows Recovery Environment behavior to gain shell access to encrypted drives, while GreenPlasma is another local privilege escalation technique aimed at achieving SYSTEM access. It was during their follow-up investigation into the GreenPlasma technique that Eclipse ran into MiniPlasma. “After re-investigating the technique used in GreenPlasma (specifically SetPolicyVal), it turns out ‘cldflt!HsmOsBlockPlaceholderAccess’ is still vulnerable to the exact same issue that was reported to Microsoft 6 years ago,” Eclipse said. The researcher reportedly disagreed with how Microsoft handled the BlueHammer disclosure, making their subsequent string of Windows vulnerability PoCs particularly interesting. “Over the past several weeks, Nightmare-Eclipse has released a relentless string of zero-day/regression disclosures,” Sarkar pointed out. “The timing is a giveaway, the MiniPlasma was released on May 13, 2026—exactly one day after Microsoft’s May Patch Tuesday cycle, ensuring defenders have no official vendor patch for weeks. But yes, that is exactly where microsegmentation integrated with existing EDR platforms helps.”