Windows LegacyHive Vulnerability Gets a Free Unofficial Patch

Free unofficial patches have appeared for a recently disclosed Windows zero-day vulnerability. The flaw, dubbed LegacyHive, lets an attacker escalate privileges on fully updated systems and has yet to be assigned a CVE identifier.

How the vulnerability works

The issue was discovered in the Windows User Profile Service by a researcher going by the pseudonym Nightmare Eclipse. He disclosed the vulnerability on the day Microsoft's July update rollout shipped (Patch Tuesday, July 2026) and accompanied it with a stripped-down proof-of-concept, deliberately crafted to make it harder for attackers to turn the finding into a ready-made weapon.

After analyzing the PoC, Will Dormann, lead vulnerability analyst at Tharros, explained: a non-administrator user can mount another user's registry hive in full-access mode and then either extract the secrets stored there or alter values that affect what gets executed on the next logon. In this way the attacker gains automatic code execution when an administrator logs in to the compromised system. Security researcher Kevin Beaumont confirmed that the exploit worked just a day after publication and posted queries for detecting attacks in Microsoft Defender for Endpoint.

Microsoft told BleepingComputer that it is aware of the report and is “actively reviewing the validity and applicability of these claims,” promising to release a fix as soon as possible.

Micropatches from 0Patch

With no official update yet available, the flaw is being closed by ACROS Security, the company behind the 0Patch platform. According to its CEO, Mitja Kolsek, with 0Patch enabled the exploit technically still fires, but instead of the administrator's real hive a temporary user profile is loaded — and that is useless to an attacker.

The vulnerability does not affect versions older than Windows 10 2004 and Windows Server 2019, so the micropatches have been released for Windows 10 2004 and later, as well as Windows Server 2022 and later. To install them, all you need to do is register a 0Patch account and launch the agent: absent any blocking policies, the fix is applied automatically and without a reboot.

Not the first find

LegacyHive is far from Nightmare Eclipse's first piece of work. In recent months the researcher has disclosed a whole series of 0-days in Windows components, Microsoft Defender, and BitLocker with telling names: RoguePlanet, BlueHammer, RedSun, YellowKey, GreenPlasma, MiniPlasma, and UnDefend. Microsoft has already closed some of them (YellowKey, GreenPlasma, and MiniPlasma in June, RoguePlanet in July), but the rest are still awaiting official patches.

Source: Bleeping Computer