# LegacyHive: Unpatched Windows User Profile Service (ProfSvc) Local Privilege Escalation Zero-Day — Public PoC Bypasses Fully Patched Systems

> Researcher NightmareEclipse (aka Chaotic Eclipse) released a public PoC named LegacyHive that abuses arbitrary registry hive loading in the Windows User Profile Service to mount another user's UsrClass.dat/NTUSER.dat hive into an attacker-controlled security context, enabling cross-user registry tampering and admin-session code execution. It works against fully patched Windows 10, Windows 11, and Windows Server 2016/2019/2022 (including the July 2026 Patch Tuesday build), has no CVE or vendor patch, and is the researcher's ninth uncoordinated Windows disclosure in three months.

- **Published:** 2026-07-17T00:00:00Z
- **Last reviewed:** 2026-07-17T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1445
- **ID:** TL-2026-1445
- **Severity:** HIGH
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Actor:** NightmareEclipse
- **Detections:** 9 · **IOCs:** 15 (full data via the Threadlinqs MCP server — Purple tier)

## Description

LegacyHive is a local privilege escalation primitive in the Windows User Profile Service (ProfSvc), the component responsible for loading a user's registry hive (NTUSER.dat / UsrClass.dat) during interactive logon. The attack chains three techniques to steer ProfSvc into loading an attacker-controlled or victim-owned hive into an unintended registry namespace: (1) offline modification of a copy of a target user's UsrClass.dat/NTUSER.dat hive staged in a temporary directory created under C:\ with a permissive DACL; (2) Object Manager symbolic-link redirection via undocumented native APIs (NtCreateSymbolicLinkObject, NtCreateDirectoryObjectEx) to reroute the profile-loading path; and (3) synchronized/racing profile loading, aided by opportunistic locks, to mount the target user's hive into the attacker's classes root before ProfSvc finalizes its own mount. The publicly released PoC (deliberately crippled by the researcher to blunt weaponization) requires credentials for a second standard local user plus a target username (which may be an administrator account), and results in the target's UsrClass.dat being mounted with read access under the attacker's profile — exposing application data, shell-folder configuration, and forensic artifacts, and providing a foothold for follow-on registry tampering (e.g., User Shell Folders redirection) that can achieve code execution the next time the targeted account, including an administrator, logs on. The researcher states the original (non-public) exploit required no additional credentials and could load arbitrary hives, meaning the released PoC materially understates true exploitability. The flaw affects all currently supported Windows 10 and Windows 11 desktop builds and Windows Server 2016, 2019, and 2022, and was independently verified to still function after installing Microsoft's July 2026 Patch Tuesday updates (600+ CVEs addressed, none covering ProfSvc hive loading). No CVE identifier has been assigned and Microsoft has not shipped a patch or workaround as of publication; Microsoft says it is 'aware of the reported vulnerability and actively investigating the validity and potential applicability,' and has publicly criticized the researcher's lack of coordinated disclosure as putting customers at 'unnecessary risk.' NightmareEclipse (alias Chaotic Eclipse), suspected by some researchers to be a disgruntled former Microsoft engineer given the sophistication and choice of targets, has released nine Windows exploits without coordinated disclosure since roughly April 2026 — including BlueHammer, UnDefend, RedSun, RoguePlanet (a Defender privilege-escalation flaw that leaked 8 bytes of data in a since-shipped 'quiet' fix), YellowKey, GreatXML (a BitLocker bypass), GreenPlasma, and MiniPlasma — repeatedly timing releases to land immediately after Patch Tuesday to maximize the exposure window, and citing grievances including mishandled vulnerability reports, denied researcher credit, revoked MSRC account access, and lack of compensation. Because no patch exists, defenders are limited to detection and hardening: security researcher Kevin Beaumont independently verified the exploit and published high-fidelity Microsoft Defender for Endpoint (MDE) KQL advanced-hunting queries designed to catch both the public PoC and likely variants by focusing on the underlying hive-mount/redirection behavior rather than static PoC artifacts. Recommended detection centers on Windows Security/Sysmon event IDs 4648 (explicit credential logon), 4624 (successful logon), 4688 (process creation), 4663 (object access), and 4657 (registry value modification), watching for non-privileged processes accessing another user's hive files, hive files staged under C:\, %TEMP%, or %ProgramData% in GUID-named folders, hives being rapidly replaced and restored within seconds of each other, and writes to Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders outside normal profile-load timing. Interim mitigations focus on restricting secondary/standard local accounts on sensitive hosts, tightening registry/profile auditing, and monitoring for the undocumented API call pattern (NtCreateDirectoryObjectEx, NtCreateSymbolicLinkObject, CreateProcessWithLogonW, LogonUser, ImpersonateLoggedOnUser) associated with the exploit chain, since no authoritative vendor fix is currently available.

## MITRE ATT&CK

- T1068 Exploitation for Privilege Escalation
- T1134 Access Token Manipulation
- T1552.002 Credentials in Registry
- T1649 Steal or Forge Authentication Certificates
- T1112 Modify Registry
- T1564 Hide Artifacts
- T1070 Indicator Removal
- T1547.001 Registry Run Keys / Startup Folder
- T1546 Event Triggered Execution
- T1543 Create or Modify System Process
- T1106 Native API
- T1569 System Services
- T1087.001 Local Account
- T1033 System Owner/User Discovery
- T1005 Data from Local System
- T1074.001 Local Data Staging
- T1550 Use Alternate Authentication Material
- T1078.003 Local Accounts

## Sources

- [New Windows LegacyHive zero-day exploit grants hackers admin access](https://www.bleepingcomputer.com/news/security/new-windows-legacyhive-zero-day-exploit-grants-hackers-admin-access/)
- [Researcher Drops New Windows Zero-Day PoC Hours After Microsoft Patch Tuesday](https://thehackernews.com/2026/07/researcher-drops-new-windows-zero-day.html)
- [Critical Windows 10, 11, and Server Zero-Day: 'LegacyHive' Exploit Enables Privilege Escalation via User Profile Service Vulnerability](https://www.rescana.com/post/critical-windows-10-11-and-server-zero-day-legacyhive-exploit-enables-privilege-escalation-via-user-profile-service-vuln)
- [Chaotic Eclipse Unveils LegacyHive Exploit Affecting Fully Patched Windows Systems](https://securityaffairs.com/195418/hacking/chaotic-eclipse-unveils-legacyhive-exploit-affecting-fully-patched-windows-systems.html)
- [LegacyHive: 'Bone-shattering' zero-day from Microsoft's serial tormentor not the haymaker that was promised](https://www.theregister.com/security/2026/07/15/microsofts-serial-tormentor-drops-legacyhive-0-day/5271723)
- [LegacyHive Zero-Day: Windows Privilege Escalation After Patch Tuesday](https://www.it-connect.tech/legacyhive-zero-day-hits-windows-just-after-july-patch-tuesday/)
- [LegacyHive Zero-Day Exposes Windows User Profile Service Hive-Loading Flaw](https://www.mallory.ai/stories/019f6463-fdcb-7436-9904-27edd29b9a47)
- [LegacyHive Ignites a New Windows Security Storm as Unpatched Zero-Day Challenges Microsoft's Disclosure Policy](https://undercodenews.com/legacyhive-ignites-a-new-windows-security-storm-as-unpatched-zero-day-challenges-microsofts-disclosure-policy-video/)
- [LegacyHive: Exploit Code and Full Details Publicly Disclosed for Unpatched Windows Privilege Escalation Flaw](https://securityonline.info/legacyhive-windows-exploit/)
- [LegacyHive: Video demo and analysis of Windows 0-day from NightmareEclipse](https://www.threatlocker.com/blog/legacyhive-video-demo-and-analysis-of-windows-0-day-from-nightmareeclipse)
- [Kevin Beaumont — Detection tips for users of Defender for Endpoint (LegacyHive)](https://www.linkedin.com/pulse/detection-tips-users-defender-endpoint-kevin-beaumont)
- [GossiTheDog/ThreatHunting — LegacyHive.kql detection query](https://github.com/GossiTheDog/ThreatHunting/blob/master/AdvancedHuntingQueries/LegacyHive.kql)
- [LegacyHive PoC repository (NightmareEclipse)](https://git.projectnightcrawler.dev/NightmareEclipse/LegacyHive)
- [International Cyber Digest — LegacyHive PoC thread](https://x.com/IntCyberDigest/status/2077145793333514593)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1445