Microsoft closes the LegacyHive zero-day in Windows

Microsoft has released security updates that close a zero-day vulnerability in Windows known as LegacyHive. The flaw was made public shortly after the July 2026 “Patch Tuesday,” while the official fix appeared only as part of the August update.

The vulnerability was disclosed by a researcher using the pseudonym Nightmare Eclipse — by his own account, in protest against the way Microsoft runs its bug bounty program and handles vulnerability disclosure. He published a proof-of-concept just a few hours after the July patches shipped, stating that the exploit affects the Windows User Profile Service. Unlike his earlier findings, the PoC for LegacyHive requires additional credentials, which makes it harder to weaponize for real-world attacks.

How it works

Analyst Will Dormann explained that an unprivileged user can use the exploit to modify the classes registry hive and achieve automatic code execution the moment an administrator logs in to the compromised system. The day after the PoC was published, expert Kevin Beaumont confirmed that the exploit works and released queries for detecting attacks in Microsoft Defender for Endpoint.

The vulnerability has now been assigned the identifier CVE-2026-62832. In Microsoft's wording, LegacyHive stems from improper link resolution before file access (link following) in the User Profile Service. An authenticated attacker who holds the credentials of another local account can run a specially crafted application to load another user's registry hive, gain access to that user's data, and ultimately obtain administrator privileges. No user interaction is required for this.

Credit and other findings

A curious detail: after fixing the vulnerability, Microsoft never credited Nightmare Eclipse as the person who discovered it, instead describing it as found by an anonymous researcher. At the same time, in an official comment the company stated that it was “aware of the reported vulnerability and is actively verifying the validity and applicability of these claims.”

Even before the official patch shipped, ACROS Security — the maker of the 0Patch platform — released free unofficial micropatches on July 20 for Windows 10 version 2004 and later, as well as Windows Server 2022 and later.

LegacyHive is far from the researcher's only finding. Since April 2026, Nightmare Eclipse has disclosed a whole series of zero-days with telling names: ShieldBreak, RoguePlanet, YellowKey, BlueHammer, RedSun, GreenPlasma, MiniPlasma, and UnDefend, affecting Microsoft Defender, BitLocker, and other Windows components. Microsoft has already closed some of them in its June and July updates, but a number of the vulnerabilities are still awaiting official fixes.

Source: Bleeping Computer