LegacyHive: Windows 0-Day Local Privilege Escalation via User Profile Service (ProfSvc) Arbitrary Registry Hive Loading

LegacyHive: Windows 0-Day Local Privilege Escalation via (TL-2026-1449), also tracked as LegacyHive, is a high-severity software vulnerability, first published 2026-07-17. It is attributed to NightmareEclipse with low confidence, affects Microsoft Windows 10, maps to 23 MITRE ATT&CK techniques (T1005, T1033, T1036), and is covered by 9 detection rules and 28 indicators of compromise.

Key facts for TL-2026-1449

Threat ID
TL-2026-1449
Also known as
LegacyHive
Severity
HIGH
Status
ACTIVE
Category
VULNERABILITY
First published
2026-07-17
Last reviewed
2026-07-17
Attribution
NightmareEclipse
Attribution confidence
LOW
Motivation
UNKNOWN
Target sectors
enterprise, government administration, critical-infrastructure, technology, managed-service-providers, education, health, finance
Target regions
Global
Detection rules
9
Indicators of compromise
28

Malware and tooling in LegacyHive: Windows 0-Day Local Privilege Escalation via

Malware and tooling: BlueHammer, GreatXML, GreenPlasma, LegacyHive, MiniPlasma, RedSun, RoguePlanet, UnDefend, YellowKey

Researcher NightmareEclipse (aka Chaotic Eclipse) publicly released LegacyHive, an unpatched Windows zero-day in the User Profile Service (ProfSvc) that lets a low-privileged, authenticated user coerce ProfSvc into mounting another user's UsrClass.dat registry hive into their own HKEY_CLASSES_ROOT namespace, exposing sensitive application data, Explorer history, and forensic artifacts. No CVE has been assigned and no patch exists; Microsoft says it is investigating.

How LegacyHive: Windows 0-Day Local Privilege Escalation via works

LegacyHive is a proof-of-concept privilege-escalation/cross-user-access primitive targeting the Windows User Profile Service (ProfSvc), the core system component responsible for loading and unloading per-user registry hives (NTUSER.DAT and UsrClass.dat) during logon/logoff. The technique chains three mechanisms: (1) offline modification of a secondary account's NTUSER.DAT to repoint the 'Local AppData' User Shell Folders value to an Object Manager path (\\.\GlobalRoot\BaseNamedObjects\Restricted); (2) creation of Object Manager directory objects and symbolic links beneath \BaseNamedObjects\Restricted\{GUID} and \BaseNamedObjects\Restricted\Microsoft that shadow the expected hive path and can be swapped mid-resolution; and (3) a synchronized/raced profile load in which an oplock is placed on a decoy hive to pause ProfSvc's load sequence while CreateProcessWithLogonW is invoked with LOGON_WITH_PROFILE and CREATE_SUSPENDED against a secondary standard-user account, whose profile load is then redirected via the swapped symlink to load the TARGET user's UsrClass.dat instead of the secondary account's own hive. Success is confirmed via RegOpenUserClassesRoot resolving to the target's namespace. The publicly released PoC is deliberately limited by the researcher to require credentials for a second standard (non-admin) helper account and is restricted to read-access mounting of UsrClass.dat only; the researcher states the original, unreleased exploit required no additional credentials and could load ANY registry hive (not just UsrClass.dat), implying a materially more severe unreleased capability. Beyond passive data exposure (application data, Windows Explorer history, forensic artifacts), documented downstream impact includes hijacking file-type associations (e.g., redirecting .txt to launch arbitrary executables such as calc.exe) and modifying COM objects/shell extensions that auto-load during a subsequent administrator logon, providing a path to code execution and persistence with administrative privileges without requiring user interaction beyond a normal admin logon. The flaw is functional against all currently supported Windows 10, Windows 11, and Windows Server (2016, 2019, 2022) editions, including systems fully patched through Microsoft's July 2026 Patch Tuesday (which itself shipped a record 622 fixes). No CVE identifier, Microsoft Security Response Center advisory, or official patch existed at time of disclosure (July 14-15, 2026); Microsoft stated only that it is 'aware of the reported vulnerability and actively investigating,' while reiterating its preference for coordinated vulnerability disclosure. LegacyHive is the researcher's ninth publicly released Windows exploit in roughly three months (following BlueHammer, UnDefend, RedSun, RoguePlanet, YellowKey, GreatXML, GreenPlasma, and MiniPlasma), amid a disclosure dispute with Microsoft dating to at least April 2026; RoguePlanet was quietly patched by Microsoft on July 9, 2026, while BlueHammer and RedSun reportedly progressed from PoC to widespread exploitation within days of release. The researcher is suspected by some analysts of being a disgruntled former Microsoft engineer based on the technical sophistication and internal knowledge reflected in the vulnerability series. Highest-risk environments are multi-user Windows systems: Remote Desktop Session Hosts, Virtual Desktop Infrastructure (VDI), and shared workstations, where standard users routinely share a host with privileged or other users' cached profiles. No patch exists; defenders are directed to detection/monitoring as the primary control, focused on cross-SID hive access, suspended cross-user process creation via CreateProcessWithLogonW, Object Manager symlink creation beneath BaseNamedObjects\Restricted, and anomalous NTUSER.DAT/UsrClass.dat modification timing.

MITRE ATT&CK techniques used in TL-2026-1449

Collection

T1005 Data from Local System; T1074.001 Local Data Staging

Discovery

T1033 System Owner/User Discovery; T1069 Permission Groups Discovery; T1083 File and Directory Discovery

Defense Evasion

T1036 Masquerading; T1134.002 Create Process with Token; T1564 Hide Artifacts

Privilege Escalation

T1068 Exploitation for Privilege Escalation; T1134 Access Token Manipulation; T1546.001 Change Default File Association

Initial Access

T1078.003 Local Accounts

Execution

T1106 Native API; T1569.002 Service Execution

defense-impairment

T1112 Modify Registry

Impact

T1489 Service Stop

Persistence

T1505 Server Software Component; T1546.001 Change Default File Association; T1546.015 Component Object Model Hijacking

Lateral Movement

T1550 Use Alternate Authentication Material

Credential Access

T1552.001 Credentials In Files; T1649 Steal or Forge Authentication Certificates

Resource Development

T1587.004 Exploits

Reconnaissance

T1592 Gather Victim Host Information

Affected products and versions in LegacyHive: Windows 0-Day Local Privilege Escalation via

  • Microsoft — Windows 10
    Vulnerable versions: all currently supported editions, fully patched through July 2026 Patch Tuesday
  • Microsoft — Windows 11
    Vulnerable versions: all currently supported editions, fully patched through July 2026 Patch Tuesday
  • Microsoft — Windows Server
    Vulnerable versions: 2016; 2019; 2022

Remediation for LegacyHive: Windows 0-Day Local Privilege Escalation via

Patches

  • No vendor patch available at time of disclosure (2026-07-15); Microsoft states the issue is under active investigation

Immediate actions

  • Increase monitoring and auditing of user registry hive files (NTUSER.DAT, UsrClass.dat) and related registry activity
  • Alert on standard-user processes modifying another user's registry hive
  • Alert on non-Windows processes replacing or rewriting ntuser.dat/UsrClass.dat files
  • Flag hive files appearing in unusual locations (C:\, %TEMP%, %ProgramData%)
  • Detect rapid hive file replacement-and-restoration cycles ('hive replaced and restored within seconds')
  • Monitor cross-user access patterns to C:\Users\*\ntuser.dat and C:\Users\*\AppData\Local\Microsoft\Windows\UsrClass.dat
  • Restrict secondary/standard user account creation and usage on sensitive, shared, RDS, and VDI hosts
  • Treat any host where NightmareEclipse-published tooling (LegacyHive, BlueHammer, UnDefend, RedSun, RoguePlanet, YellowKey, GreatXML, GreenPlasma, MiniPlasma) is observed as potentially compromised

Workarounds

  • Restrict which accounts may interactively/RDP logon to multi-user hosts to reduce the pool of usable helper accounts
  • Disable or tightly control secondary/standard local accounts on Remote Desktop Session Hosts and VDI images
  • Increase registry/file auditing (SACLs) on user profile directories and monitor Event IDs 4648, 4624, 4688, 4663, 4657

Longer-term hardening

  • Segment and harden administrative workstations away from general multi-user/shared systems
  • Restrict local interactive logon rights for privileged accounts on shared/RDS/VDI hosts
  • Deploy EDR/behavioral detection tuned to CreateProcessWithLogonW + LOGON_WITH_PROFILE + CREATE_SUSPENDED combined with cross-SID targets
  • Enhance credential security awareness training given the helper-account credential requirement in the current PoC
  • Track Microsoft Security Response Center for an eventual CVE/patch and apply it immediately upon release

Weaknesses (CWE) in LegacyHive: Windows 0-Day Local Privilege Escalation via

CWE-269, CWE-284, CWE-863, CWE-362

Timeline of LegacyHive: Windows 0-Day Local Privilege Escalation via

  • NightmareEclipse (Chaotic Eclipse) and Microsoft become locked in a disclosure-practices dispute, marking the start of a rapid-fire series of public zero-day releases.
  • Microsoft ships July 2026 Patch Tuesday containing a record 622 fixes; LegacyHive functions on systems fully updated with this release.
  • RoguePlanet, an earlier NightmareEclipse-released exploit, is quietly patched by Microsoft.
  • NightmareEclipse publicly releases the LegacyHive proof-of-concept and repository, timed shortly after Patch Tuesday to maximize the unpatched exposure window.
  • The Hacker News and The Register publish coverage of LegacyHive, including researcher background and the Microsoft disclosure dispute.
  • Independent researchers Will Dormann and Kevin Beaumont publicly confirm the exploit works and remains unpatched; ThreatLocker and Cyderes publish technical detection analyses.
  • Microsoft states it is aware of the reported vulnerability and is actively investigating, while reiterating a preference for coordinated vulnerability disclosure; no patch or advisory is issued.
  • Threadlinqs Intelligence Platform ingests and researches the LegacyHive disclosure via automated threat-intel pipeline.

Sources cited for LegacyHive: Windows 0-Day Local Privilege Escalation via

Threats related to LegacyHive: Windows 0-Day Local Privilege Escalation via

Detection coverage for TL-2026-1449

As of 2026-07-17, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1449 across Splunk SPL, Microsoft KQL and Sigma, covering 28 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats