Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability

The remote Windows host is affected by an elevation of privilege vulnerability in the Cloud Files Mini Filter Driver (cldflt.sys), known as MiniPlasma. An authenticated, local attacker can exploit this issue to elevate privileges to SYSTEM. Although Microsoft originally addressed this issue in December 2020, the fix has since regressed, and a publicly available proof-of-concept exploit demonstrates that the vulnerability is once again exploitable on currently patched hosts as of May 2026.

The remote Windows host is missing security update 4592446.
It is, therefore, affected by multiple vulnerabilities:

  - A security feature bypass vulnerability exists. An     attacker can exploit this and bypass the security     feature and perform unauthorized actions compromising     the integrity of the system/application.
    (CVE-2020-17099)

  - A remote code execution vulnerability. An attacker can     exploit this to bypass authentication and execute     unauthorized arbitrary commands. (CVE-2020-17095,     CVE-2020-17096)

  - An elevation of privilege vulnerability. An attacker can     exploit this to gain elevated privileges.
    (CVE-2020-16958, CVE-2020-16959, CVE-2020-16960,     CVE-2020-16961, CVE-2020-16962, CVE-2020-16963,     CVE-2020-16964, CVE-2020-17092, CVE-2020-17097,     CVE-2020-17103, CVE-2020-17134, CVE-2020-17136)

  - An information disclosure vulnerability. An attacker can     exploit this to disclose potentially sensitive     information. (CVE-2020-17094, CVE-2020-17098,     CVE-2020-17140)

The remote Windows host is missing security update 4592449.
It is, therefore, affected by multiple vulnerabilities:

  - An elevation of privilege vulnerability. An attacker can     exploit this to gain elevated privileges.
    (CVE-2020-16958, CVE-2020-16959, CVE-2020-16960,     CVE-2020-16961, CVE-2020-16962, CVE-2020-16963,     CVE-2020-16964, CVE-2020-17092, CVE-2020-17097,     CVE-2020-17103, CVE-2020-17134, CVE-2020-17136)

  - A remote code execution vulnerability. An attacker can     exploit this to bypass authentication and execute     unauthorized arbitrary commands. (CVE-2020-17095,     CVE-2020-17096)

  - A security feature bypass vulnerability exists. An     attacker can exploit this and bypass the security     feature and perform unauthorized actions compromising     the integrity of the system/application.
    (CVE-2020-17139)

  - An information disclosure vulnerability. An attacker can     exploit this to disclose potentially sensitive     information. (CVE-2020-17094, CVE-2020-17098,     CVE-2020-17140)

The remote Windows host is missing security update 4592440. It is, therefore, affected by multiple vulnerabilities:

  - An elevation of privilege vulnerability. An attacker can     exploit this to gain elevated privileges.
    (CVE-2020-16958, CVE-2020-16959, CVE-2020-16960,     CVE-2020-16961, CVE-2020-16962, CVE-2020-16963,     CVE-2020-16964, CVE-2020-17092, CVE-2020-17097,     CVE-2020-17103, CVE-2020-17134, CVE-2020-17136)

  - A remote code execution vulnerability. An attacker can     exploit this to bypass authentication and execute     unauthorized arbitrary commands. (CVE-2020-17095,     CVE-2020-17096)

  - An information disclosure vulnerability. An attacker can     exploit this to disclose potentially sensitive     information. (CVE-2020-17094, CVE-2020-17098,     CVE-2020-17140)

  - A security feature bypass vulnerability exists. An     attacker can exploit this and bypass the security     feature and perform unauthorized actions compromising     the integrity of the system/application.
    (CVE-2020-16996, CVE-2020-17099, CVE-2020-17139)

The remote Windows host is missing security update 4592438.
It is, therefore, affected by multiple vulnerabilities:

  - A remote code execution vulnerability. An attacker can     exploit this to bypass authentication and execute     unauthorized arbitrary commands. (CVE-2020-17095,     CVE-2020-17096)

  - An memory corruption vulnerability exists. An attacker     can exploit this to corrupt the memory and cause     unexpected behaviors within the system/application.
    (CVE-2020-17131)

  - An information disclosure vulnerability. An attacker can     exploit this to disclose potentially sensitive     information. (CVE-2020-17094, CVE-2020-17098,     CVE-2020-17140)

  - A security feature bypass vulnerability exists. An     attacker can exploit this and bypass the security     feature and perform unauthorized actions compromising     the integrity of the system/application.
    (CVE-2020-17139)

  - An elevation of privilege vulnerability. An attacker can     exploit this to gain elevated privileges.
    (CVE-2020-16958, CVE-2020-16959, CVE-2020-16960,     CVE-2020-16961, CVE-2020-16962, CVE-2020-16963,     CVE-2020-16964, CVE-2020-17092, CVE-2020-17097,     CVE-2020-17103, CVE-2020-17134, CVE-2020-17136,     CVE-2020-17137)

ID	Name	Product	Family	Severity
316497	Windows Cloud Files Mini Filter Driver EoP (MiniPlasma) (Direct Check) (CVE-2020-17103)	Nessus	Windows	high
143571	KB4592446: Windows 10 Version 1803 December 2020 Security Update	Nessus	Windows : Microsoft Bulletins	critical
143570	KB4592449: Windows 10 Version 1903 and Windows 10 Version 1909 December 2020 Security Update	Nessus	Windows : Microsoft Bulletins	critical
143561	KB4592440: Windows 10 Version 1809 and Windows Server 2019 December 2020 Security Update	Nessus	Windows : Microsoft Bulletins	critical
143558	KB4592438: Windows 10 Version 2004 December 2020 Security Update	Nessus	Windows : Microsoft Bulletins	critical

Detections

Analytics

CVE-2020-17103

high

Tenable Plugins

high

critical

critical

critical

critical