LegacyHive: Unpatched Windows User Profile Service (profsvc) Registry Hive Hijack Privilege Escalation 0-Day PoC Released by Nightmare-Eclipse

LegacyHive: Unpatched Windows User Profile Service (profsvc) (TL-2026-1373), also tracked as LegacyHive, is a high-severity software vulnerability scored CVSS 7.8, first published 2026-07-15. It is attributed to Nightmare Eclipse with high confidence, affects Microsoft Windows (desktop and server, all currently supported, maps to 17 MITRE ATT&CK techniques (T1003.002, T1033, T1055.003), and is covered by 9 detection rules and 15 indicators of compromise.

Key facts for TL-2026-1373

Threat ID
TL-2026-1373
Also known as
LegacyHive
Severity
HIGH
CVSS
7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Status
ACTIVE
Category
VULNERABILITY
First published
2026-07-15
Last reviewed
2026-07-15
Attribution
Nightmare Eclipse
Attribution confidence
HIGH
Motivation
UNKNOWN
Target sectors
government administration, finance, health, technology, education, critical-infrastructure, managed-service-providers
Target regions
Global
Detection rules
9
Indicators of compromise
15

Malware and tooling in LegacyHive: Unpatched Windows User Profile Service (profsvc)

Malware and tooling: BlueHammer, LegacyHive, RedSun, RoguePlanet, UnDefend

Researcher Nightmare-Eclipse publicly released "LegacyHive," a proof-of-concept local privilege escalation exploit abusing a trust-boundary flaw in the Windows User Profile Service (profsvc), letting a standard user mount another account's registry hive — including an administrator's — into their own classes root via a timed path-switching / symbolic-link redirection trick. No CVE has been assigned and Microsoft has not committed to an out-of-band patch; the public PoC is deliberately weakened (requires a second standard-user credential set and is limited to usrclass.dat) while the researcher claims an unrestricted original exists.

How LegacyHive: Unpatched Windows User Profile Service (profsvc) works

On 2026-07-15, security researcher Nightmare-Eclipse (also tracked in press coverage as Chaotic Eclipse / Dead Eclipse), a self-described former Microsoft employee running a retaliatory disclosure campaign against the company, published proof-of-concept exploit code and technical details for "LegacyHive," a Windows local privilege escalation (LPE) vulnerability in the Windows User Profile Service (profsvc.dll, hosted in svchost.exe). profsvc is responsible for loading a user's registry hive (NTUSER.DAT and UsrClass.dat) at logon and unloading it at logoff. LegacyHive abuses a race condition / timed path-switching technique combined with symbolic links and NT object-manager directory objects to redirect profsvc's file operations during the hive-load sequence, causing it to mount a different, targeted user's UsrClass.dat hive underneath the attacker's own HKEY_CLASSES_ROOT rather than the intended account's. Because HKCR is consulted for COM/OLE class registration and shell integration, an attacker who can write into a victim's mounted classes root gains a code-execution primitive that runs in the victim's security context — including SYSTEM or an administrator, if the targeted profile belongs to one.

The technique directly echoes a historical class of profsvc symlink hive-loading bugs (e.g., CVE-2015-0004 / MS15-003, CVE-2019-0986, CVE-2020-0785), all previously patched by Microsoft, indicating profsvc's hive-loading path has been a recurring, incompletely-remediated attack surface for over a decade. Nightmare-Eclipse states the flaw survives the July 2026 Patch Tuesday round (622 fixes) and affects all currently supported Windows desktop and server SKUs.

The publicly released PoC is intentionally hobbled: it requires the attacker to already control a second standard-user credential set on the target host and is restricted to loading only UsrClass.dat (not the more sensitive NTUSER.DAT or SAM-adjacent hives). The researcher states the original, unpublished version removes both restrictions and works with a single standard-user foothold. Independent commentary from Matei Badanoiu (Pentest-Tools.com) characterizes the primitive as "genuinely useful" for an attacker who already has a foothold; Dray Agha (Huntress) urged threat-intel teams to "act with some urgency."

LegacyHive is the seventh zero-day released by Nightmare-Eclipse since April 2026, following BlueHammer (CVE-2026-33825, patched April 2026 Patch Tuesday), RedSun (CVE-2026-41091) and UnDefend (CVE-2026-45498) — both patched via an out-of-band Windows Defender engine update on 2026-05-21 after Huntress observed the tooling used in a live intrusion chained with FortiGate VPN compromise for initial access — as well as MiniPlasma, YellowKey, GreenPlasma, and most recently RoguePlanet (CVE-2026-50656), a Windows Defender quarantine-pipeline abuse LPE that Microsoft patched quietly in July 2026 without public acknowledgment of severity. Microsoft has previously threatened legal action against the researcher rather than engaging on the technical merits, which press coverage frames as fueling further disclosures. As of publication, Microsoft has not confirmed an emergency/out-of-band patch timeline for LegacyHive and no in-the-wild exploitation of LegacyHive itself has been confirmed, though three of the researcher's prior six exploits (BlueHammer, RedSun, UnDefend) were subsequently observed in live intrusions, establishing a pattern of rapid third-party weaponization for this actor's releases.

MITRE ATT&CK techniques used in TL-2026-1373

Credential Access

T1003.002 Security Account Manager; T1555.004 Windows Credential Manager

Discovery

T1033 System Owner/User Discovery; T1069.001 Local Groups; T1087.001 Local Account

Defense Evasion

T1055.003 Thread Execution Hijacking; T1211 Exploitation for Stealth

Privilege Escalation

T1068 Exploitation for Privilege Escalation; T1134 Access Token Manipulation; T1134.002 Create Process with Token

defense-impairment

T1112 Modify Registry

Impact

T1489 Service Stop

Persistence

T1543.003 Windows Service; T1546.015 Component Object Model Hijacking; T1547.001 Registry Run Keys / Startup Folder

Lateral Movement

T1550.002 Pass the Hash

Execution

T1569.002 Service Execution

Affected products and versions in LegacyHive: Unpatched Windows User Profile Service (profsvc)

  • Microsoft — Windows (desktop and server, all currently supported versions)
    Vulnerable versions: Windows 10 (all supported builds); Windows 11 (all supported builds); Windows Server (all currently supported versions)

Remediation for LegacyHive: Unpatched Windows User Profile Service (profsvc)

Patches

  • No vendor patch available as of 2026-07-15; no CVE assigned; Microsoft has not confirmed an out-of-band release timeline

Immediate actions

  • Limit creation and standing membership of local standard-user accounts on multi-user and terminal-server systems
  • Monitor Windows User Profile Service (profsvc) for unexpected or out-of-sequence registry hive load/unload events
  • Alert on registry activity under HKEY_CLASSES_ROOT / HKEY_USERS\<SID>_Classes that does not match the logged-on user's own SID
  • Audit for anomalous NT object-manager symbolic link creation (CreateSymbolicLink / NtCreateSymbolicLinkObject) by non-administrative processes
  • Restrict interactive/RDP logon rights on shared or terminal-server hosts to reduce the pool of co-resident standard-user accounts an attacker could target or need

Workarounds

  • Restrict local standard-user account provisioning and disable unused local accounts
  • Increase logging verbosity on profsvc (Microsoft-Windows-User Profile Service ETW provider) to catch anomalous hive mounts
  • Segregate high-privilege accounts from hosts where untrusted standard users can log on interactively

Longer-term hardening

  • Apply Microsoft's patch immediately once released; track July 2026 Patch Tuesday follow-up advisories for profsvc
  • Deploy EDR rules for CreateProcessWithLogonW / CreateProcessAsUser calls where the invoking and target account SIDs mismatch
  • Harden object-manager namespace permissions to reduce symlink-based redirection opportunities (historically mitigated for CVE-2015-0004 class bugs; verify mitigation still holds against this variant)
  • Adopt Just Enough Administration / tiered-admin models to reduce the value of any single hive-hijack primitive

Weaknesses (CWE) in LegacyHive: Unpatched Windows User Profile Service (profsvc)

CWE-59, CWE-367, CWE-269, CWE-706, CWE-668

Timeline of LegacyHive: Unpatched Windows User Profile Service (profsvc)

  • BlueHammer local privilege escalation (CVE-2026-33825) patched by Microsoft in the April 2026 Patch Tuesday cycle.
  • Nightmare-Eclipse begins a retaliatory zero-day disclosure campaign against Microsoft, releasing BlueHammer (later CVE-2026-33825), the first of what becomes seven public Windows exploits over roughly three and a half months.
  • Barracuda publishes retrospective on Nightmare-Eclipse's six-zero-days-in-six-weeks campaign, framing it as grudge-driven disclosure.
  • Huntress observes Nightmare-Eclipse tooling (BlueHammer, RedSun, UnDefend) used in a live intrusion chained with FortiGate VPN compromise for initial access; Microsoft ships an out-of-band Windows Defender engine update patching RedSun (CVE-2026-41091) and UnDefend (CVE-2026-45498).
  • Researcher publicly promises further "bone-shattering" disclosures against Microsoft.
  • Nightmare-Eclipse releases RoguePlanet, a Windows Defender quarantine-pipeline abuse LPE later assigned CVE-2026-50656; Microsoft acknowledges working on a patch.
  • Microsoft quietly patches RoguePlanet (CVE-2026-50656) without prominent public acknowledgment of its severity, as reported by The Register.
  • securityonline.info publishes initial technical writeup on LegacyHive ahead of broader press pickup, noting no CVE assigned and no confirmed in-the-wild exploitation at that time.
  • Microsoft does not confirm an emergency/out-of-band patch timeline for LegacyHive when queried by press.
  • The Register publishes "Microsoft's serial tormentor drops LegacyHive 0-day," including practitioner commentary from Matei Badanoiu (Pentest-Tools.com) and Dray Agha (Huntress) on real-world usefulness and urgency.
  • Nightmare-Eclipse publicly releases the LegacyHive proof-of-concept and technical writeup, deliberately timed immediately after July 2026 Patch Tuesday to maximize the unpatched exposure window.
  • Microsoft ships July 2026 Patch Tuesday with 622 fixes; LegacyHive is not addressed.

Sources cited for LegacyHive: Unpatched Windows User Profile Service (profsvc)

Threats related to LegacyHive: Unpatched Windows User Profile Service (profsvc)

Detection coverage for TL-2026-1373

As of 2026-07-15, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1373 across Splunk SPL, Microsoft KQL and Sigma, covering 15 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats