# Microsoft Analysis: 78% of Exploited Vulnerabilities Enable System Takeover and Privilege Escalation

> Microsoft's data-driven analysis of ~383,000 CVEs (1999-September 2026) finds that of the ~2,000 linked to real-world exploitation, 78% enable system takeover or privilege escalation. Exploitation concentrates in server-side RCE, local privilege escalation and authentication bypass, and 29% of 2025 exploits launched within one day of CVE publication.

- **Published:** 2026-11-04T03:57:50Z
- **Last reviewed:** 2026-11-04T03:57:50Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5208
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5208.png
- **ID:** TL-2026-5208
- **Severity:** MEDIUM
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 10
- **CVEs:** CVE-2020-17103, CVE-2025-62221

## Description

On 2026-11-02 Microsoft Security Research published 'What exploited vulnerabilities have in common: A data-driven analysis of real-world attacks'. The study covers CVEs published through September 2026 from Microsoft's tracked vulnerability catalog, correlated with CISA KEV data, CVE.org metrics and VulnCheck's State of Exploitation 2026 research. Each CVE is counted once by impact class across Windows, Linux/Unix, mobile, network appliances, IoT/OT, virtualization hosts and developer packages. Of roughly 383,000 published CVEs only about 2,000 (~0.5%, fewer than 1 in 200) are linked to real-world exploitation, and 78% of exploited CVEs (1,239 remote-takeover CVEs analyzed) give attackers system takeover or privilege escalation.

The exploited population differs sharply from the published population. Server-side RCE is 20% of published CVEs but 37% of exploited; local privilege escalation 11% vs 18%; client-side RCE 4% vs 13%; OS vulnerabilities 23% vs 41% of exploited (77% of all CVEs are in application code, 23% in OS code). Cross-site scripting (15% to 4%) and denial of service (16% to 7%) are under-represented among exploited CVEs. Microsoft notes that a vulnerability's stated classification does not always reflect what an attacker can reliably achieve in practice.

Time-to-exploitation is shrinking: 29% of 2025 exploits launched within one day of CVE publication. Mean time from CVE publication to CISA KEV listing fell from 89 days (2024) to 57 days (2025) to 20 days (2026 through September), with a 2026 median of 3 days. Median patch times lag attackers: about 2 weeks for Windows workstations, over 1 month for Windows servers, over 10 weeks for Linux servers and macOS applications, and over 1 year for network appliances.

The coverage cites Windows local privilege-escalation examples: a Windows CLFS driver flaw, the MiniPlasma zero-day and a Cloud Files driver zero-day. Per secondary reporting, MiniPlasma is a public PoC by researcher Chaotic Eclipse (Nightmare-Eclipse) abusing the Cloud Filter driver (cldflt.sys) CfAbortHydration API to create a registry key in the .DEFAULT user hive without access checks, yielding SYSTEM on fully patched Windows 11 (May 2026 updates); it is tied to CVE-2020-17103, originally reported by James Forshaw in September 2020. A separate cldflt.sys flaw, CVE-2025-62221, was patched in December 2025 after in-the-wild exploitation. This is trend-level vendor research: no threat actor, malware family, campaign or network IOCs are named in the primary source, so no BeaconBeagle correlation was applicable.

Microsoft's guidance: prioritize takeover vulnerabilities (server-side RCE, authentication bypass, local privilege escalation); discover internet-facing assets with external attack surface management; rank remediation beyond CVSS using threat signals, breach likelihood, exposure and asset criticality; and use attack path analysis to break attack chains before they reach sensitive resources.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1203 Exploitation for Client Execution
- T1112 Modify Registry
- T1588.006 Obtain Capabilities: Vulnerabilities

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**MiniPlasma / CVE-2020-17103 cldflt.sys Registry Key Creation in HKU\.DEFAULT by User-Writable Process** (`TL-2026-5208-SPL-001`)

Detects the behavioural footprint of the MiniPlasma Cloud Filter driver (cldflt.sys) local privilege escalation (CfAbortHydration abuse, related to CVE-2020-17103): a non-SYSTEM process running from a user-writable path (Users, ProgramData, Temp) creating or setting keys under HKEY_USERS\.DEFAULT, which the exploit reaches without access checks before obtaining SYSTEM. Behaviour-first; requires Sysmon registry events (EventCode 12/13).

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1068, T1112, T1211
- **Data sources:** sysmon, windows_registry
- **Severity:** high
- **Confidence:** medium

### Splunk SPL

```spl
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode IN (12,13) TargetObject="HKU\\.DEFAULT\\*" NOT User="NT AUTHORITY\\SYSTEM"
| eval img=lower(Image)
| where match(img, "\\\\(users|programdata|temp)\\\\") AND NOT match(img, "\\\\microsoft\\\\onedrive\\\\")
| stats count min(_time) as first_seen max(_time) as last_seen values(EventType) as event_types values(TargetObject) as registry_keys by host, User, Image, ProcessGuid
| convert ctime(first_seen) ctime(last_seen)
```

### Microsoft KQL

```kql
DeviceRegistryEvents
| where Timestamp > ago(24h)
| where ActionType in ("RegistryKeyCreated", "RegistryValueSet")
| where RegistryKey startswith @"HKEY_USERS\.DEFAULT\"
| where InitiatingProcessAccountName !~ "system"
| where InitiatingProcessFolderPath matches regex @"(?i)\\(Users|ProgramData|Temp)\\"
| where InitiatingProcessFolderPath !contains @"\Microsoft\OneDrive\"
| project Timestamp, DeviceName, InitiatingProcessAccountName, InitiatingProcessFileName, InitiatingProcessFolderPath, InitiatingProcessCommandLine, ActionType, RegistryKey, RegistryValueName
```

### Sigma

```yaml
title: MiniPlasma CVE-2020-17103 Registry Write in HKU DEFAULT by User-Writable Process
id: 3b7f1c52-8a1e-4d6b-9c42-5e0a7d1f2b01
status: experimental
description: Detects a non-SYSTEM process in a user-writable path creating or setting registry keys under HKU\.DEFAULT, the behaviour of the MiniPlasma cldflt.sys CfAbortHydration privilege escalation.
references:
    - https://www.microsoft.com/en-us/security/blog/2026/11/02/exploited-vulnerabilities-common-data-driven-analysis-real-world-attacks/
    - https://nvd.nist.gov/vuln/detail/CVE-2020-17103
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-11-04
tags:
    - attack.privilege-escalation
    - attack.t1068
    - attack.defense-evasion
    - attack.t1112
    - attack.t1211
    - attack.tool.miniplasma
    - cve.2020-17103
logsource:
    category: registry_event
    product: windows
detection:
    selection:
        TargetObject|startswith: 'HKU\.DEFAULT\'
        EventType:
            - 'CreateKey'
            - 'SetValue'
        Image|contains:
            - '\Users\'
            - '\ProgramData\'
            - '\Temp\'
    filter_system:
        User: 'NT AUTHORITY\SYSTEM'
    filter_onedrive:
        Image|contains: '\Microsoft\OneDrive\'
    condition: selection and not 1 of filter_*
falsepositives:
    - Software installers or per-user tools that legitimately write default-profile settings
    - Profile or logon-script tooling run from user-writable paths
level: high

```

**Known false positives:**

- Per-user installers or profile-management tools running from Temp/ProgramData that seed HKU\.DEFAULT settings
- Endpoint/IT tooling executed from a user profile that writes default-profile registry values

**Tuning notes:** Baseline 14 days of EventCode 12/13 under HKU\.DEFAULT and allow-list signed installer and profile-tool Image paths. Pair alerts with SPL-002 (SYSTEM shell from the same parent) to raise confidence. Not yet tested against a live MiniPlasma run; kernel-side key creation attribution to the calling Image should be confirmed in a lab.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Server-Side RCE Exploitation: Web/Application Server Worker Spawning Shell or Script Host (T1190) (locked: unlock with TL Creds)
- Client-Side RCE Exploitation: Office, PDF Reader or Browser Spawning Shell or Script Host (T1203) (locked: unlock with TL Creds)
- Cloud Files API (cldapi.dll) Loaded by Non-Sync-Provider Process in User-Writable Path - MiniPlasma CfAbortHydration Surface (locked: unlock with TL Creds)
- CLFS Privilege Escalation Staging: Non-System Process Creating .blf Log Files in User-Writable Paths ([indicator]) (locked: unlock with TL Creds)
- Post-Exploitation Default-Hive Tampering: SYSTEM Shell Modifying HKU\.DEFAULT After Local Privilege Escalation (T1112) (locked: unlock with TL Creds)
- MiniPlasma PoC Execution: Process Image or Command Line Referencing MiniPlasma / CfAbortHydration (locked: unlock with TL Creds)
- SYSTEM Shell Spawned by User-Writable-Path Parent (LPE Outcome, CVE-2020-17103 / CVE-2025-62221 class) (locked: unlock with TL Creds)
- MiniPlasma PoC Acquisition: Download Artifact Referencing Nightmare-Eclipse / MiniPlasma (T1588.006, T1105) (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sources

- [What exploited vulnerabilities have in common: A data-driven analysis of real-world attacks (Microsoft Security Blog)](https://www.microsoft.com/en-us/security/blog/2026/11/02/exploited-vulnerabilities-common-data-driven-analysis-real-world-attacks/)
- [Microsoft Reveals 78% of Exploited Vulnerabilities Enable System Takeover and Privilege Escalation (Cyber Security News)](https://cybersecuritynews.com/microsoft-reveals-78-of-exploited-vulnerabilities/)
- [VulnCheck State of Exploitation 1H 2026](https://www.vulncheck.com/blog/state-of-exploitation-1h-2026)
- [CISA Known Exploited Vulnerabilities Catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)
- [New Windows 'MiniPlasma' zero-day exploit gives SYSTEM access, PoC released (BleepingComputer)](https://www.bleepingcomputer.com/news/microsoft/new-windows-miniplasma-zero-day-exploit-gives-system-access-poc-released/)
- [MiniPlasma Windows 0-Day Enables SYSTEM (The Hacker News)](https://thehackernews.com/2026/05/miniplasma-windows-0-day-enables-system.html)
- [MiniPlasma: Windows privilege escalation zero-day affects fully patched systems (ThreatLocker)](https://www.threatlocker.com/blog/miniplasma-windows-privilege-escalation-zero-day-affects-fully-patched-systems)
- [NVD - CVE-2020-17103](https://nvd.nist.gov/vuln/detail/CVE-2020-17103)
- [NVD - CVE-2025-62221](https://nvd.nist.gov/vuln/detail/CVE-2025-62221)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5208