LegacyHive: Unpatched Windows User Profile Service (ProfSvc) Local Privilege Escalation Zero-Day — Public PoC Bypasses Fully Patched Systems — Threadlinqs Intelligence
As of 2026-07-17, LegacyHive: Unpatched Windows User Profile Service (ProfSvc) Local Privilege Escalation Zero-Day — Public PoC Bypasses Fully Patched Systems is a high-severity vulnerability threat attributed to NightmareEclipse, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 15 indicators of compromise.
Threat ID: TL-2026-1445 · Severity: HIGH · Status: ACTIVE · Category: VULNERABILITY
Attribution: NightmareEclipse · UNKNOWN
Researcher NightmareEclipse (aka Chaotic Eclipse) released a public PoC named LegacyHive that abuses arbitrary registry hive loading in the Windows User Profile Service to mount another user's
LegacyHive is a local privilege escalation primitive in the Windows User Profile Service (ProfSvc), the component responsible for loading a user's registry hive (NTUSER.dat / UsrClass.dat) during interactive logon. The attack chains three techniques to steer ProfSvc into loading an attacker-controlled or victim-owned hive into an unintended registry namespace: (1) offline modification of a copy of a target user's UsrClass.dat/NTUSER.dat hive staged in a temporary directory created under C:\ with a permissive DACL; (2) Object Manager symbolic-link redirection via undocumented native APIs (NtCreateSymbolicLinkObject, NtCreateDirectoryObjectEx) to reroute the profile-loading path; and (3) synchronized/racing profile loading, aided by opportunistic locks, to mount the target user's hive into the attacker's classes root before ProfSvc finalizes its own mount. The publicly released PoC (deliberately crippled by the researcher to blunt weaponization) requires credentials for a second standard local user plus a target username (which may be an administrator account), and results in the target's UsrClass.dat being mounted with read access under the attacker's profile — exposing application data, shell-folder configuration, and forensic artifacts, and providing a foothold for follow-on registry tampering (e.g., User Shell Folders redirection) that can achieve code execution the next time the targeted account, including an administrator, logs on. The researcher states the original (non-public) exploit required no additional credentials and could load arbitrary hives, meaning the released PoC materially understates true exploitability. The flaw affects all currently supported Windows 10 and Windows 11 desktop builds and Windows Server 2016, 2019, and 2022, and was independently verified to still function after installing Microsoft's July 2026 Patch Tuesday updates (600+ CVEs addressed, none covering ProfSvc hive loading). No CVE identifier has been assigned and Microsoft has not shipped a patch or workaround as of publication; Microsoft says it is 'aware of the reported vulnerability and actively investigating the validity and potential applicability,' and has publicly criticized the researcher's lack of coordinated disclosure as putting customers at 'unnecessary risk.' NightmareEclipse (alias Chaotic Eclipse), suspected by some researchers to be a disgruntled former Microsoft engineer given the sophistication and choice of targets, has released nine Windows exploits without coordinated disclosure since roughly April 2026 — including BlueHammer, UnDefend, RedSun, RoguePlanet (a Defender privilege-escalation flaw that leaked 8 bytes of data in a since-shipped 'quiet' fix), YellowKey, GreatXML (a BitLocker bypass), GreenPlasma, and MiniPlasma — repeatedly timing releases to land immediately after Patch Tuesday to maximize the exposure window, and citing grievances including mishandled vulnerability reports, denied researcher credit, revoked MSRC account access, and lack of compensation. Because no patch exists, defenders are limited to detection and hardening: security researcher Kevin Beaumont independently verified the exploit and published high-fidelity Microsoft Defender for Endpoint (MDE) KQL advanced-hunting queries designed to catch both the public PoC and likely variants by focusing on the underlying hive-mount/redirection behavior rather than static PoC artifacts. Recommended detection centers on Windows Security/Sysmon event IDs 4648 (explicit credential logon), 4624 (successful logon), 4688 (process creation), 4663 (object access), and 4657 (registry value modification), watching for non-privileged processes accessing another user's hive files, hive files staged under C:\, %TEMP%, or %ProgramData% in GUID-named folders, hives being rapidly replaced and restored within seconds of each other, and writes to Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders outside normal profile-load timing. Interim mitigations f
Weaknesses (CWE)
CWE-269, CWE-732, CWE-362, CWE-668
Target sectors: government administration, finance, health, technology, education, manufacturing, retail, energy, telecoms, legal
Target regions: Global, North America, Europe, Asia-Pacific
Detections & IOCs
As of 2026-07-28, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 15 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
VULNERABILITY, HIGH, threat intelligence, cybersecurity, T1068, T1134, T1552.002, T1649, T1112, T1564, T1070, T1547.001, T1546, T1543