# LegacyHive: Windows 0-Day Local Privilege Escalation via User Profile Service (ProfSvc) Arbitrary Registry Hive Loading

> Researcher NightmareEclipse (aka Chaotic Eclipse) publicly released LegacyHive, an unpatched Windows zero-day in the User Profile Service (ProfSvc) that lets a low-privileged, authenticated user coerce ProfSvc into mounting another user's UsrClass.dat registry hive into their own HKEY_CLASSES_ROOT namespace, exposing sensitive application data, Explorer history, and forensic artifacts. No CVE has been assigned and no patch exists; Microsoft says it is investigating.

- **Published:** 2026-07-17T00:00:00Z
- **Last reviewed:** 2026-07-17T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1449
- **ID:** TL-2026-1449
- **Severity:** HIGH
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Actor:** NightmareEclipse
- **Detections:** 9 · **IOCs:** 28 (full data via the Threadlinqs MCP server — Purple tier)

## Description

LegacyHive is a proof-of-concept privilege-escalation/cross-user-access primitive targeting the Windows User Profile Service (ProfSvc), the core system component responsible for loading and unloading per-user registry hives (NTUSER.DAT and UsrClass.dat) during logon/logoff. The technique chains three mechanisms: (1) offline modification of a secondary account's NTUSER.DAT to repoint the 'Local AppData' User Shell Folders value to an Object Manager path (\\.\GlobalRoot\BaseNamedObjects\Restricted); (2) creation of Object Manager directory objects and symbolic links beneath \BaseNamedObjects\Restricted\{GUID} and \BaseNamedObjects\Restricted\Microsoft that shadow the expected hive path and can be swapped mid-resolution; and (3) a synchronized/raced profile load in which an oplock is placed on a decoy hive to pause ProfSvc's load sequence while CreateProcessWithLogonW is invoked with LOGON_WITH_PROFILE and CREATE_SUSPENDED against a secondary standard-user account, whose profile load is then redirected via the swapped symlink to load the TARGET user's UsrClass.dat instead of the secondary account's own hive. Success is confirmed via RegOpenUserClassesRoot resolving to the target's namespace. The publicly released PoC is deliberately limited by the researcher to require credentials for a second standard (non-admin) helper account and is restricted to read-access mounting of UsrClass.dat only; the researcher states the original, unreleased exploit required no additional credentials and could load ANY registry hive (not just UsrClass.dat), implying a materially more severe unreleased capability. Beyond passive data exposure (application data, Windows Explorer history, forensic artifacts), documented downstream impact includes hijacking file-type associations (e.g., redirecting .txt to launch arbitrary executables such as calc.exe) and modifying COM objects/shell extensions that auto-load during a subsequent administrator logon, providing a path to code execution and persistence with administrative privileges without requiring user interaction beyond a normal admin logon. The flaw is functional against all currently supported Windows 10, Windows 11, and Windows Server (2016, 2019, 2022) editions, including systems fully patched through Microsoft's July 2026 Patch Tuesday (which itself shipped a record 622 fixes). No CVE identifier, Microsoft Security Response Center advisory, or official patch existed at time of disclosure (July 14-15, 2026); Microsoft stated only that it is 'aware of the reported vulnerability and actively investigating,' while reiterating its preference for coordinated vulnerability disclosure. LegacyHive is the researcher's ninth publicly released Windows exploit in roughly three months (following BlueHammer, UnDefend, RedSun, RoguePlanet, YellowKey, GreatXML, GreenPlasma, and MiniPlasma), amid a disclosure dispute with Microsoft dating to at least April 2026; RoguePlanet was quietly patched by Microsoft on July 9, 2026, while BlueHammer and RedSun reportedly progressed from PoC to widespread exploitation within days of release. The researcher is suspected by some analysts of being a disgruntled former Microsoft engineer based on the technical sophistication and internal knowledge reflected in the vulnerability series. Highest-risk environments are multi-user Windows systems: Remote Desktop Session Hosts, Virtual Desktop Infrastructure (VDI), and shared workstations, where standard users routinely share a host with privileged or other users' cached profiles. No patch exists; defenders are directed to detection/monitoring as the primary control, focused on cross-SID hive access, suspended cross-user process creation via CreateProcessWithLogonW, Object Manager symlink creation beneath BaseNamedObjects\Restricted, and anomalous NTUSER.DAT/UsrClass.dat modification timing.

## MITRE ATT&CK

- T1592 Gather Victim Host Information
- T1587.004 Exploits
- T1078.003 Local Accounts
- T1569.002 Service Execution
- T1106 Native API
- T1546.001 Change Default File Association
- T1546.015 Component Object Model Hijacking
- T1505 Server Software Component
- T1068 Exploitation for Privilege Escalation
- T1134 Access Token Manipulation
- T1546.001 Change Default File Association
- T1112 Modify Registry
- T1036 Masquerading
- T1134.002 Create Process with Token
- T1564 Hide Artifacts
- T1649 Steal or Forge Authentication Certificates
- T1552.001 Credentials In Files
- T1083 File and Directory Discovery
- T1033 System Owner/User Discovery
- T1069 Permission Groups Discovery
- T1550 Use Alternate Authentication Material
- T1005 Data from Local System
- T1074.001 Local Data Staging
- T1489 Service Stop

## Sources

- [New LegacyHive Windows 0-day Vulnerability Released by Nightmare-Eclipse With PoC Details](https://cybersecuritynews.com/windows-legacyhive-0-day-vulnerability/)
- [LegacyHive Windows 0-Day Vulnerability](https://cybersecuritynews.com/legacyhive-windows-0-day-vulnerability/)
- [Researcher Drops New Windows Zero-Day PoC Hours After Microsoft Patch Tuesday](https://thehackernews.com/2026/07/researcher-drops-new-windows-zero-day.html)
- [Microsoft's serial tormentor drops LegacyHive 0-day](https://www.theregister.com/security/2026/07/15/microsofts-serial-tormentor-drops-legacyhive-0-day/5271723)
- [LegacyHive: Video demo and analysis of Windows 0-day from NightmareEclipse](https://www.threatlocker.com/blog/legacyhive-video-demo-and-analysis-of-windows-0-day-from-nightmareeclipse)
- [Critical Windows 10, 11, and Server Zero-Day: 'LegacyHive' Exploit Enables Privilege Escalation via User Profile Service Vulnerability](https://www.rescana.com/post/critical-windows-10-11-and-server-zero-day-legacyhive-exploit-enables-privilege-escalation-via-user-profile-service-vuln)
- [LegacyHive Zero-Day: Windows Privilege Escalation After Patch Tuesday](https://www.it-connect.tech/legacyhive-zero-day-hits-windows-just-after-july-patch-tuesday/)
- [LegacyHive Windows ProfSvc Zero-Day: Detect and Contain LPE](https://windowsforum.com/threads/legacyhive-windows-profsvc-zero-day-detect-and-contain-lpe.439039/)
- [Windows User Profile Service Arbitrary Hive Loading Vulnerability](https://www.cyderes.com/howler-cell/legacyhive-windows-user-profile-loading-vulnerability)
- [New LegacyHive Windows Zero-Day Could Give Attackers Admin Access](https://windowsreport.com/new-legacyhive-windows-zero-day-could-give-attackers-admin-access/)
- [LegacyHive PoC repository](https://git.projectnightcrawler.dev/NightmareEclipse/LegacyHive)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1449