Reported by 1 outlet
Windows LegacyHive Zero-Day — Privilege Escalation on Fully Patched Systems
Why this score
- Breadth
- 0.50 / 2.0 · 1 source
- Authority
- 1.80 / 2.0 · best outlet weight
- Severity
- 0.80 / 5.0 · CVSS + content signals
- Velocity
- 0.00 / 2.0 · updates in 48h
- Pickup speed
- 0.00 / 0.6 · time to second source
- Recency
- × 0.00 temporal multiplier
- Community
- + 0.00 / 1.5 · reddit signal
- Score
- 0.0 / 10 = base × recency + community
Timeline
-
original reporting
Windows LegacyHive Zero-Day — Privilege Escalation on Fully Patched Systems
· 85d ago · July 21st, 2026
A Windows zero-day vulnerability dubbed LegacyHive (no CVE assigned) in the Windows User Profile Service allows non-admin users to modify the classes registry hive and gain automatic code execution when an admin logs in. Disclosed by researcher "Nightmare Eclipse" on Patch Tuesday (July 14), the flaw works on up-to-date Windows systems. Tharrows analyst Will Dormann confirmed the exploit chain; Kevin Beaumont validated it within a day and published Defender for Endpoint hunting queries.
Microsoft says it is "actively investigating." Free unofficial patches are now available from third parties. The disclosure timing — intentionally aligned with Patch Tuesday — is notable; Nightmare Eclipse released a stripped PoC to limit immediate weaponization.
Action: Apply unofficial mitigations where available. Deploy Kevin Beaumont's MDE hunting queries. Monitor User Profile Service registry modifications.
Sources: BleepingComputer
-
update from bleepingcomputer.com
Microsoft patches LegacyHive Windows zero-day vulnerability
bleepingcomputer.com · 61d ago · August 13th, 2026
The security flaw was disclosed by a security researcher who uses the " Nightmare Eclipse " handle in protest of Microsoft's bug bounty and vulnerability disclosure practices. Nightmare Eclipse published a LegacyHive proof-of-concept (PoC) exploit hours after the July 2026 Patch Tuesday security updates were released, claiming it exploits a security vulnerability in the Windows User Profile Service. However, unlike previous exploits they released, the LegacyHive PoC requires additional credentials, making it harder for threat actors to weaponize the vulnerability. "Microsoft is aware of the reported vulnerability and is actively investigating the validity and potential applicability of these claims," a Microsoft spokesperson told BleepingComputer when asked for a statement regarding LegacyHive. Official LegacyHive patches available Microsoft has now patched the vulnerability this week as part of