# CVE-2015-0004

> As of 2024-08-06, CVE-2015-0004 is a vulnerability, EPSS 3.5% (89.0th percentile). Threadlinqs Intelligence links 1 tracked threat campaign to CVE-2015-0004, most recently “LegacyHive: Unpatched Windows User Profile Service (profsvc) Registry Hive Hijack Privilege Escalation 0-Day PoC Released by Nightmare-Eclipse”.

**Last updated:** 2024-08-06

## What is CVE-2015-0004?

The User Profile Service (aka ProfSvc) in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows local users to gain privileges by conducting a junction attack to load another user's UsrClass.dat registry hive, aka MSRC ID 20674 or "Microsoft User Profile Service Elevation of Privilege Vulnerability."

The identifier was first published 4306 days ago.

## Severity and exploitation probability

- **EPSS (FIRST):** 3.5% probability of exploitation in the next 30 days, higher than 89.0% of all scored CVEs
- **CISA KEV:** Not listed in the CISA Known Exploited Vulnerabilities catalog
- **Threadlinqs priority:** 3.6/10 — a Threadlinqs composite of the CVSS base score, the EPSS percentile and public exploit availability
- **Published:** 2015-01-13, last modified 2024-08-06

## Is CVE-2015-0004 being exploited?

It currently carries a trending score of 27 in the Threadlinqs vulnerability feed.

## Affected products and versions

No affected-product or package list has been recorded for CVE-2015-0004 in the tracked sources. The vendor advisory and the references below are the authoritative statement of what is affected.

## How to fix CVE-2015-0004

No vendor patch reference has been recorded for CVE-2015-0004 in the tracked sources. Follow the references below for a fix, and treat any affected deployment as exposed until the vendor states otherwise.

## Threat activity tracking CVE-2015-0004

1 tracked threat in the Threadlinqs corpus references CVE-2015-0004, either in the campaign’s CVE list or as an indicator on the campaign record.

- [LegacyHive: Unpatched Windows User Profile Service (profsvc) Registry Hive Hijack Privilege Escalation 0-Day PoC Released by Nightmare-Eclipse](https://intel.threadlinqs.com/threat/TL-2026-1373) — HIGH · 2026-07-15

## Sources

Enriched from CVE.org, FIRST EPSS, GitHub Security Advisories. Last verified by Threadlinqs on 2026-10-10.

**Vendor advisory and patch**

- [docs.microsoft.com — vendor advisory](https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-003)

**Third-party advisory**

- [secunia.com — third party advisory](http://secunia.com/advisories/61927)

**Vulnerability database entry**

- [securityfocus.com — vdb entry](http://www.securityfocus.com/bid/71967)
- [exchange.xforce.ibmcloud.com — vdb entry](https://exchange.xforce.ibmcloud.com/vulnerabilities/99519)
- [exchange.xforce.ibmcloud.com — vdb entry (99520)](https://exchange.xforce.ibmcloud.com/vulnerabilities/99520)

**Other references**

- [code.google.com](https://code.google.com/p/google-security-research/issues/detail?id=123)

Canonical: https://intel.threadlinqs.com/cve/CVE-2015-0004
Full detection coverage and IOCs for threats exploiting CVE-2015-0004 via the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp