Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability

CVE-2020-17103 is a Windows Cloud Files Mini Filter Driver (cldflt.sys) elevation-of-privilege flaw in the Cloud Files stack used by Windows and features like OneDrive Files On-Demand. Microsoft published it in December 2020 for Windows 10 1803/1809/1903/1909/2004/20H2 and Windows Server 2016/2019-era builds, with fixes originally shipped via the December 8, 2020 cumulative updates such as KB4592438, KB4592449, KB4592440, and KB4592446.

The vendor's HIGH 7.0 rating was reasonable in 2020, but the 2026 MiniPlasma disclosure changes the operational picture: a public PoC now claims the original flaw regressed or remained reachable on fully patched modern Windows, and that claim was independently tested by outside reporters. That raises confidence in exploitability, but not to CRITICAL, because the attacker still needs local code execution and low privileges first.

Why this verdict

• Baseline stays high: Microsoft rated it 7.0 HIGH, and that baseline is fair because successful exploitation yields SYSTEM on a ubiquitous enterprise platform.
• Upward adjustment for weaponization: A public MiniPlasma PoC appeared in May 2026, Tenable shipped detection around it, and outside testing reportedly reproduced SYSTEM compromise on patched Windows. That removes a lot of the old 'maybe not practical' discount.
• Downward pressure for attacker position: The chain requires local execution plus low privileges, which means this is post-initial-access. That sharply narrows the reachable population versus a remote pre-auth flaw and is why this does not become CRITICAL.

Why not higher?

Because this bug does not give attackers a foothold. It needs a user-context process already running on the box, so the exploit rides *after* phishing, browser compromise, stolen credentials, or some other initial access event. Also, there is still no authoritative KEV entry or firm evidence of broad in-the-wild abuse.

Why not lower?

Because on Windows fleets, a cheap local privesc is not housekeeping noise. Once a public PoC exists and reportedly works on fully patched systems, every successful low-priv compromise becomes much more likely to end in durable SYSTEM ownership. For enterprise defenders, that is squarely a HIGH operational problem.

1. Harden initial execution paths — Treat this as a post-compromise amplifier and reduce the chances of step one ever happening: tighten email/web controls, block untrusted script and binary execution, and enforce application control. For a HIGH verdict, deploy or validate these controls within 30 days.
2. Prioritize EDR detections for local privesc chains — Tune for suspicious user-to-SYSTEM process transitions, exploit staging from temp/user-writable paths, and defense-tampering behavior immediately after elevation. This will not prevent the kernel bug itself, but it can contain the host takeover path; deploy tuning within 30 days.
3. Reduce local admin and developer sprawl — The more users and build agents that can run arbitrary code locally, the more usable this class of bug becomes. Remove unnecessary local execution rights and clean up broad software install permissions within 30 days.
4. Segment and protect post-elevation targets — Use Credential Guard, LSASS protections, tamper protection, and lateral-movement controls so a single SYSTEM win does not become domain-wide impact. These are compensating controls for the blast radius and should be validated within 30 days.

Run this on the target Windows host as a local administrator or via your endpoint management agent. Example: powershell.exe -ExecutionPolicy Bypass -File .\Check-CVE-2020-17103.ps1. It performs a build-based sanity check only: hosts missing the original December 2020 baseline are marked VULNERABLE; hosts at or above that baseline are marked UNKNOWN because current reporting says the issue may be exploitable again on patched systems and Microsoft has not published a clearly attributable superseding fixed build in the sources reviewed.

# Check-CVE-2020-17103.ps1

# Build-based verifier for the original 2020 remediation baseline.

# Because 2026 reporting alleges regression/re-exploitability on patched systems,

# this script can only confidently say VULNERABLE when the original baseline is absent.

# Otherwise it returns UNKNOWN until Microsoft publishes a definitive superseding fix.

# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN, 3=ERROR


[CmdletBinding()]
param()

$ErrorActionPreference = 'Stop'

function Get-OSInfo {
    $cv = Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion'
    [pscustomobject]@{
        ProductName   = $cv.ProductName
        DisplayVersion = $cv.DisplayVersion
        ReleaseId     = $cv.ReleaseId
        CurrentBuild  = [int]$cv.CurrentBuild
        UBR           = [int]$cv.UBR
        BuildString   = "$($cv.CurrentBuild).$($cv.UBR)"
    }
}

function Get-CldfltInfo {
    $path = Join-Path $env:windir 'System32\drivers\cldflt.sys'
    if (-not (Test-Path $path)) {
        return $null
    }
    $item = Get-Item $path
    [pscustomobject]@{
        Path = $path
        Version = $item.VersionInfo.FileVersion
        LastWriteTime = $item.LastWriteTimeUtc
    }
}

function Test-Original2020Baseline {
    param(
        [int]$Build,
        [int]$UBR
    )

    # Original December 8, 2020 fixed baselines reviewed in Microsoft/Rapid7 sources:

    # 17134.1902 (1803 / KB4592446)

    # 17763.1637 (1809 / Server 2019 / KB4592440)

    # 18362.1256 (1903 / KB4592449)

    # 18363.1256 (1909 / KB4592449)

    # 19041.685  (2004 / KB4592438)

    # 19042.685  (20H2 / KB4592438)


    switch ($Build) {
        17134 { return ($UBR -ge 1902) }
        17763 { return ($UBR -ge 1637) }
        18362 { return ($UBR -ge 1256) }
        18363 { return ($UBR -ge 1256) }
        19041 { return ($UBR -ge 685) }
        19042 { return ($UBR -ge 685) }
        default { return $null }
    }
}

try {
    $os = Get-OSInfo
    $drv = Get-CldfltInfo

    Write-Output "Host: $env:COMPUTERNAME"
    Write-Output "OS: $($os.ProductName)"
    Write-Output "Build: $($os.BuildString)"

    if ($null -eq $drv) {
        Write-Output 'UNKNOWN - cldflt.sys not found; unable to assess this host with this script.'
        exit 2
    }

    Write-Output "cldflt.sys: $($drv.Version) [$($drv.Path)]"

    $baseline = Test-Original2020Baseline -Build $os.CurrentBuild -UBR $os.UBR

    if ($baseline -eq $false) {
        Write-Output 'VULNERABLE - host is below the original December 2020 remediation baseline for CVE-2020-17103.'
        exit 1
    }

    if ($baseline -eq $true) {
        Write-Output 'UNKNOWN - host meets the original 2020 patch baseline, but public 2026 reporting alleges regression/re-exploitability on patched systems. A definitive current fixed build was not identified in reviewed sources.'
        exit 2
    }

    Write-Output 'UNKNOWN - this Windows build is outside the original 2020 branch mapping in this script. Manual validation required.'
    exit 2
}
catch {
    Write-Output ('ERROR - ' + $_.Exception.Message)
    exit 3
}

Sources

1. NVD CVE record
2. Project Zero mini-filter research
3. Microsoft KB4592438
4. Rapid7 vulnerability entry with patch mappings
5. BleepingComputer MiniPlasma report
6. SecurityWeek MiniPlasma report
7. Tenable plugin 316497
8. CISA KEV catalog