LegacyHive: Unpatched Windows User Profile Service (ProfSvc) Local Privilege Escalation Zero-Day — Public PoC Bypasses Fully Patched Systems

LegacyHive: Unpatched Windows User Profile Service (ProfSvc) (TL-2026-1445), also tracked as LegacyHive, is a high-severity software vulnerability, first published 2026-07-17. It is attributed to NightmareEclipse with medium confidence, affects Microsoft Windows 10, maps to 18 MITRE ATT&CK techniques (T1005, T1033, T1068), and is covered by 9 detection rules and 15 indicators of compromise.

Key facts for TL-2026-1445

Threat ID
TL-2026-1445
Also known as
LegacyHive
Severity
HIGH
Status
ACTIVE
Category
VULNERABILITY
First published
2026-07-17
Last reviewed
2026-07-17
Attribution
NightmareEclipse
Attribution confidence
MEDIUM
Motivation
UNKNOWN
Target sectors
government administration, finance, health, technology, education, manufacturing, retail, energy, telecoms, legal
Target regions
Global, North America, Europe, Asia-Pacific
Detection rules
9
Indicators of compromise
15

Malware and tooling in LegacyHive: Unpatched Windows User Profile Service (ProfSvc)

Malware and tooling: LegacyHive, LegacyHive.kql

Researcher NightmareEclipse (aka Chaotic Eclipse) released a public PoC named LegacyHive that abuses arbitrary registry hive loading in the Windows User Profile Service to mount another user's UsrClass.dat/NTUSER.dat hive into an attacker-controlled security context, enabling cross-user registry tampering and admin-session code execution. It works against fully patched Windows 10, Windows 11, and Windows Server 2016/2019/2022 (including the July 2026 Patch Tuesday build), has no CVE or vendor patch, and is the researcher's ninth uncoordinated Windows disclosure in three months.

How LegacyHive: Unpatched Windows User Profile Service (ProfSvc) works

LegacyHive is a local privilege escalation primitive in the Windows User Profile Service (ProfSvc), the component responsible for loading a user's registry hive (NTUSER.dat / UsrClass.dat) during interactive logon. The attack chains three techniques to steer ProfSvc into loading an attacker-controlled or victim-owned hive into an unintended registry namespace: (1) offline modification of a copy of a target user's UsrClass.dat/NTUSER.dat hive staged in a temporary directory created under C:\ with a permissive DACL; (2) Object Manager symbolic-link redirection via undocumented native APIs (NtCreateSymbolicLinkObject, NtCreateDirectoryObjectEx) to reroute the profile-loading path; and (3) synchronized/racing profile loading, aided by opportunistic locks, to mount the target user's hive into the attacker's classes root before ProfSvc finalizes its own mount. The publicly released PoC (deliberately crippled by the researcher to blunt weaponization) requires credentials for a second standard local user plus a target username (which may be an administrator account), and results in the target's UsrClass.dat being mounted with read access under the attacker's profile — exposing application data, shell-folder configuration, and forensic artifacts, and providing a foothold for follow-on registry tampering (e.g., User Shell Folders redirection) that can achieve code execution the next time the targeted account, including an administrator, logs on. The researcher states the original (non-public) exploit required no additional credentials and could load arbitrary hives, meaning the released PoC materially understates true exploitability. The flaw affects all currently supported Windows 10 and Windows 11 desktop builds and Windows Server 2016, 2019, and 2022, and was independently verified to still function after installing Microsoft's July 2026 Patch Tuesday updates (600+ CVEs addressed, none covering ProfSvc hive loading). No CVE identifier has been assigned and Microsoft has not shipped a patch or workaround as of publication; Microsoft says it is 'aware of the reported vulnerability and actively investigating the validity and potential applicability,' and has publicly criticized the researcher's lack of coordinated disclosure as putting customers at 'unnecessary risk.' NightmareEclipse (alias Chaotic Eclipse), suspected by some researchers to be a disgruntled former Microsoft engineer given the sophistication and choice of targets, has released nine Windows exploits without coordinated disclosure since roughly April 2026 — including BlueHammer, UnDefend, RedSun, RoguePlanet (a Defender privilege-escalation flaw that leaked 8 bytes of data in a since-shipped 'quiet' fix), YellowKey, GreatXML (a BitLocker bypass), GreenPlasma, and MiniPlasma — repeatedly timing releases to land immediately after Patch Tuesday to maximize the exposure window, and citing grievances including mishandled vulnerability reports, denied researcher credit, revoked MSRC account access, and lack of compensation. Because no patch exists, defenders are limited to detection and hardening: security researcher Kevin Beaumont independently verified the exploit and published high-fidelity Microsoft Defender for Endpoint (MDE) KQL advanced-hunting queries designed to catch both the public PoC and likely variants by focusing on the underlying hive-mount/redirection behavior rather than static PoC artifacts. Recommended detection centers on Windows Security/Sysmon event IDs 4648 (explicit credential logon), 4624 (successful logon), 4688 (process creation), 4663 (object access), and 4657 (registry value modification), watching for non-privileged processes accessing another user's hive files, hive files staged under C:\, %TEMP%, or %ProgramData% in GUID-named folders, hives being rapidly replaced and restored within seconds of each other, and writes to Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders outside normal profile-load timing. Interim mitigations focus on restricting secondary/standard local accounts on sensitive hosts, tightening registry/profile auditing, and monitoring for the undocumented API call pattern (NtCreateDirectoryObjectEx, NtCreateSymbolicLinkObject, CreateProcessWithLogonW, LogonUser, ImpersonateLoggedOnUser) associated with the exploit chain, since no authoritative vendor fix is currently available.

MITRE ATT&CK techniques used in TL-2026-1445

Collection

T1005 Data from Local System; T1074.001 Local Data Staging

Discovery

T1033 System Owner/User Discovery; T1087.001 Local Account

Privilege Escalation

T1068 Exploitation for Privilege Escalation; T1134 Access Token Manipulation

Defense Evasion

T1070 Indicator Removal; T1564 Hide Artifacts

Initial Access

T1078.003 Local Accounts

Execution

T1106 Native API; T1569 System Services

defense-impairment

T1112 Modify Registry

Persistence

T1543 Create or Modify System Process; T1546 Event Triggered Execution; T1547.001 Registry Run Keys / Startup Folder

Lateral Movement

T1550 Use Alternate Authentication Material

Credential Access

T1552.002 Credentials in Registry; T1649 Steal or Forge Authentication Certificates

Affected products and versions in LegacyHive: Unpatched Windows User Profile Service (ProfSvc)

  • Microsoft — Windows 10
    Vulnerable versions: all currently supported Windows 10 builds, including July 2026 Patch Tuesday
  • Microsoft — Windows 11
    Vulnerable versions: all currently supported Windows 11 builds, including July 2026 Patch Tuesday
  • Microsoft — Windows Server
    Vulnerable versions: 2016; 2019; 2022

Remediation for LegacyHive: Unpatched Windows User Profile Service (ProfSvc)

Patches

  • No vendor patch or CVE issued as of publication (July 2026); Microsoft states it is investigating

Immediate actions

  • Restrict interactive logon and standard-user account proliferation on sensitive/shared endpoints and servers to reduce dual-account exploitation surface
  • Deploy Kevin Beaumont's published MDE KQL detection queries (github.com/GossiTheDog/ThreatHunting) for high-fidelity LegacyHive hunting
  • Enable and centralize registry auditing (event ID 4657) and object-access auditing (event ID 4663) on profile-hive-related registry keys
  • Monitor for hive files (NTUSER.dat, UsrClass.dat) created or duplicated in C:\, %TEMP%, or %ProgramData% under GUID-named folders outside normal profile paths
  • Alert on rapid create/replace/delete cycles of hive files within seconds, indicative of the racing/opportunistic-lock technique

Workarounds

  • Restrict which standard user accounts can log on interactively to hosts where administrators also log on
  • Increase monitoring/auditing of User Shell Folders registry path (Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders) for unexpected writes

Longer-term hardening

  • Deploy EDR behavioral detection tuned to undocumented native API sequences (NtCreateDirectoryObjectEx, NtCreateSymbolicLinkObject) combined with profile-load timing
  • Segment administrator logon sessions away from hosts where standard users can co-locate accounts
  • Track Microsoft's response and apply the official patch/advisory the moment one ships; no CVE exists yet to monitor via standard vulnerability feeds
  • Review local account provisioning policy to minimize the number of standard user accounts able to co-reside on privileged-logon endpoints

Weaknesses (CWE) in LegacyHive: Unpatched Windows User Profile Service (ProfSvc)

CWE-269, CWE-732, CWE-362, CWE-668

Timeline of LegacyHive: Unpatched Windows User Profile Service (ProfSvc)

  • NightmareEclipse (Chaotic Eclipse) begins a run of uncoordinated Windows zero-day disclosures, starting with BlueHammer and continuing through UnDefend, RedSun, YellowKey, GreenPlasma, and MiniPlasma over the following months.
  • Microsoft MSRC publicly characterizes the researcher's disclosures (including YellowKey and GreenPlasma) as 'irresponsible' due to lack of coordination.
  • RoguePlanet, a Microsoft Defender local privilege-escalation flaw from the same researcher, is publicly disclosed; Microsoft later ships a 'quiet' defense-in-depth fix that itself introduces an 8-byte data-disclosure issue.
  • GreatXML, a BitLocker bypass from the same researcher, is publicly disclosed.
  • NightmareEclipse publicly releases the LegacyHive PoC on a self-hosted Git repository, hours after Microsoft's July 2026 Patch Tuesday (600+ CVEs patched, none covering ProfSvc hive loading).
  • The Register, Security Affairs, The Hacker News, Rescana, and other outlets publish technical analyses of LegacyHive.
  • Microsoft states it is 'aware of the reported vulnerability and actively investigating the validity and potential applicability,' and criticizes the lack of prior coordinated disclosure.
  • Independent researchers (including Kevin Beaumont and Matei Badanoiu) verify the exploit functions on fully patched Windows 10, Windows 11, and Windows Server 2016/2019/2022 systems.
  • Kevin Beaumont publishes high-fidelity KQL advanced-hunting detection queries for Microsoft Defender for Endpoint targeting LegacyHive's underlying hive-mount behavior, plus a video demo/analysis is published by ThreatLocker.
  • BleepingComputer publishes coverage summarizing the flaw, its impact on fully patched systems, and the lack of a CVE or vendor patch.

Sources cited for LegacyHive: Unpatched Windows User Profile Service (ProfSvc)

Threats related to LegacyHive: Unpatched Windows User Profile Service (ProfSvc)

Detection coverage for TL-2026-1445

As of 2026-07-17, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1445 across Splunk SPL, Microsoft KQL and Sigma, covering 15 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats