LegacyHive: Local Privilege Escalation PoC via Windows User Profile Service (ProfSvc) Registry Hive Mounting
LegacyHive: Local Privilege Escalation PoC via Windows User (TL-2026-1499), also tracked as LegacyHive, is a medium-severity software vulnerability, first published 2026-07-18. It is attributed to Nightmare Eclipse with high confidence, affects Microsoft Windows 10, maps to 13 MITRE ATT&CK techniques (T1005, T1033, T1068), and is covered by 9 detection rules and 26 indicators of compromise.
Key facts for TL-2026-1499
- Threat ID
- TL-2026-1499
- Also known as
- LegacyHive
- Severity
- MEDIUM
- Status
- ACTIVE
- Category
- VULNERABILITY
- First published
- 2026-07-18
- Last reviewed
- 2026-07-18
- Attribution
- Nightmare Eclipse
- Attribution confidence
- HIGH
- Motivation
- UNKNOWN
- Target sectors
- all sectors using windows desktop or server endpoints
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 26
Malware and tooling in LegacyHive: Local Privilege Escalation PoC via Windows User
Malware and tooling: BlueHammer, LegacyHive, RedSun, RoguePlanet
Researcher Nightmare Eclipse (alias Chaotic Eclipse) released a stripped-down proof-of-concept named LegacyHive on 2026-07-14/15, hours after Microsoft's July 2026 Patch Tuesday, abusing the Windows User Profile Service (ProfSvc) to mount another user's registry hive (UsrClass.dat) into a low-privileged user's classes root, exposing protected administrative registry data on fully patched Windows 10, 11, and Server systems. No CVE, vendor advisory, or patch exists.
How LegacyHive: Local Privilege Escalation PoC via Windows User works
LegacyHive is an uncoordinated-disclosure local privilege escalation (LPE) technique targeting the Windows User Profile Service (ProfSvc) and the logic it uses to load user registry hives during logon. The exploit chains three mechanisms: offline modification of a registry hive file, Object Manager symbolic link redirection (via undocumented NT APIs NtCreateSymbolicLinkObject and NtCreateDirectoryObjectEx), and opportunistic-lock (oplock)-based synchronization to intercept and redirect the profile-loading sequence. The published technique creates a temporary staging directory with a permissive DACL under C:\ (frequently GUID-named), uses LogonUser/CreateProcessWithLogonW/ImpersonateLoggedOnUser to establish a secondary standard-user logon context, and drives Object Registry (OR*) hive APIs (OROpenHiveByHandle, OROpenKey, ORSetValue, ORSaveHive) together with RegOpenUserClassesRoot to cause a target user's UsrClass.dat hive to end up mounted inside the classes root of a different, lower-privileged user's registry namespace. The result is cross-user hive redirection: a target user's UsrClass.dat (which stores file-association data, shell/Explorer history, COM/shell extension registrations, and application preferences) becomes readable and, per the researcher, writable by an unrelated standard user.
The publicly released PoC is intentionally incomplete. It requires (1) existing code execution as a standard user, (2) valid credentials for a second, unrelated standard-user account, and (3) the target username (an administrator account is the highest-value target) — and in this released form it works only against the usrclass.dat hive rather than the full NTUSER.DAT/UsrClass.dat set the researcher claims a more complete internal version supports. The researcher described the throttled release as deliberately requiring "some brain cells" to weaponize further, and multiple outlets frame the restriction as a response to Microsoft's legal posture toward the researcher's prior disclosures.
LegacyHive functions against all supported Windows 10 and Windows 11 desktop builds and Windows Server 2016/2019/2022, including systems fully patched as of the July 2026 Patch Tuesday, because it exploits a logic/design flaw in hive-loading rather than a specific unpatched code defect. No CVE has been assigned, no Microsoft Security Response Center (MSRC) advisory has been published, and no security update is available; MSRC has stated only that it is "actively investigating the validity" of the report and that the details were not shared with Microsoft prior to publication, which it called a departure from coordinated disclosure that "put[s] our customers at unnecessary risk."
LegacyHive is the ninth uncoordinated Windows zero-day PoC released since April 2026 by the same researcher, following BlueHammer, UnDefend, RedSun, RoguePlanet, YellowKey, GreatXML, GreenPlasma, and MiniPlasma. Some outlets speculate the researcher is a disgruntled former Microsoft engineer and note the pattern is believed to stem from a dispute with Microsoft over its vulnerability-reporting/bug-bounty process; prior releases from the same researcher (BlueHammer, RedSun) reportedly progressed from PoC to widespread exploitation within days of release. Independent analysts assess LegacyHive as "a genuinely useful primitive" for post-compromise lateral movement and credential/data harvesting rather than a standalone initial-access or full-system-compromise exploit, since it presupposes the attacker already has standard-user code execution and a second standard user's credentials. Analysts nonetheless warned that capable adversaries would likely reverse-engineer the withheld components quickly, given no patch or workaround currently exists.
MITRE ATT&CK techniques used in TL-2026-1499
Collection
Discovery
T1033 System Owner/User Discovery; T1083 File and Directory Discovery
Privilege Escalation
T1068 Exploitation for Privilege Escalation
defense-impairment
T1112 Modify Registry; T1685 Disable or Modify Tools
Defense Evasion
T1134 Access Token Manipulation; T1574 Hijack Execution Flow
Persistence
T1547 Boot or Logon Autostart Execution
Lateral Movement
T1550 Use Alternate Authentication Material
Credential Access
T1552 Unsecured Credentials; T1555 Credentials from Password Stores
Execution
Affected products and versions in LegacyHive: Local Privilege Escalation PoC via Windows User
- Microsoft — Windows 10
Vulnerable versions: all supported versions, including July 2026 Patch Tuesday builds - Microsoft — Windows 11
Vulnerable versions: all supported versions, including July 2026 Patch Tuesday builds - Microsoft — Windows Server
Vulnerable versions: 2016; 2019; 2022 (fully patched as of July 2026) - Microsoft — Windows User Profile Service (ProfSvc)
Vulnerable versions: all currently shipping versions
Remediation for LegacyHive: Local Privilege Escalation PoC via Windows User
Immediate actions
- Increase monitoring of user registry hive files (NTUSER.DAT, UsrClass.dat) for access, modification, or replacement by non-owning accounts
- Audit and tighten permissions on C:\Users\*\ntuser.dat and C:\Users\*\AppData\Local\Microsoft\Windows\UsrClass.dat
- Restrict or remove unnecessary secondary standard-user accounts on sensitive/shared endpoints and servers
- Alert on CreateProcessWithLogonW invocations where the launching account and target account/SID do not match expectations
- Monitor for creation of GUID-named staging directories directly under C:\ with permissive DACLs
- Enable and review Windows Security Event IDs 4648 (explicit credential logon), 4624 (successful logon), 4688 (process creation), 4663 (object access), and 4657 (registry value modified) for cross-account hive access patterns
Workarounds
- Restrict standard-user code execution and secondary local-account provisioning on high-value endpoints and servers until a patch is available
- Apply strict ACLs / monitoring to registry hive files and the Windows\ServiceProfiles / user profile directories
Longer-term hardening
- Deploy EDR/behavioral detection tuned to Object Manager symbolic-link abuse (NtCreateSymbolicLinkObject, NtCreateDirectoryObjectEx) and oplock-based file/registry redirection techniques
- Enforce least-privilege on endpoints so standard users do not routinely share systems with administrative accounts
- Track MSRC advisories for LegacyHive and apply the official patch once released
- Incorporate ProfSvc/hive-mounting abuse into red-team and detection-validation exercises for lateral movement and local privilege escalation coverage
Weaknesses (CWE) in LegacyHive: Local Privilege Escalation PoC via Windows User
CWE-269, CWE-284, CWE-59
Timeline of LegacyHive: Local Privilege Escalation PoC via Windows User
- Researcher Chaotic Eclipse (Nightmare Eclipse) begins a pattern of uncoordinated Windows zero-day PoC releases, starting with BlueHammer, followed by UnDefend, RedSun, RoguePlanet, YellowKey, GreatXML, GreenPlasma, and MiniPlasma over subsequent months; BlueHammer and RedSun are each reported to have progressed from PoC to widespread exploitation within days of release.
- NightmareEclipse publicly promises to release another "bone-shattering" Windows zero-day, foreshadowing the LegacyHive drop.
- Microsoft issues a quiet remediation for NightmareEclipse's prior RoguePlanet zero-day (a Defender vulnerability) without publishing mitigation details; the defensive update is separately reported to have caused Microsoft Defender to leak data in certain scenarios.
- Chaotic Eclipse publishes the LegacyHive proof-of-concept exploit hours after Patch Tuesday, describing it as a "Windows User Profile Service arbitrary hive load elevation of privilege" issue targeting ProfSvc; the PoC is intentionally stripped down to limit weaponization.
- Microsoft releases its July 2026 Patch Tuesday security updates, fixing a record 622 flaws.
- Security Affairs, The Hacker News, The Register, and other outlets publish technical coverage of LegacyHive, describing its ProfSvc hive-mounting mechanics, the record-sized July Patch Tuesday it followed, and the lack of an available patch.
- Detection engineering and threat-intel platforms (Rescana, detections.ai, Mallory, Windows Forum) publish behavioral detection guidance, MITRE ATT&CK mappings, and monitoring recommendations for LegacyHive.
- Microsoft states it is "aware of the reported vulnerability and is actively investigating the validity and potential applicability of these claims," and separately characterizes the release as an uncoordinated disclosure that "put[s] our customers at unnecessary risk" since details were not shared with Microsoft prior to publication.
- As of this writing, no CVE has been assigned, no Microsoft advisory has been published, and no security update is available; LegacyHive remains exploitable on fully patched Windows 10, Windows 11, and Windows Server 2016/2019/2022 systems.
Sources cited for LegacyHive: Local Privilege Escalation PoC via Windows User
- Chaotic Eclipse unveils LegacyHive exploit affecting fully patched Windows systems
- Researcher Drops New Windows Zero-Day PoC Hours After Microsoft Patch Tuesday
- LegacyHive: 'Bone-shattering' zero-day from Microsoft's serial tormentor not the haymaker that was promised
- Critical Windows 10, 11, and Server Zero-Day: 'LegacyHive' Exploit Enables Privilege Escalation via User Profile Service Vulnerability
- Chaotic Eclipse Unveils LegacyHive Exploit Affecting Fully Patched Windows Systems
- LegacyHive Ignites a New Windows Security Storm as Unpatched Zero-Day Challenges Microsoft's Disclosure Policy
- LegacyHive Zero-Day: Windows Privilege Escalation After Patch Tuesday
- LegacyHive Windows ProfSvc Zero-Day: Detect and Contain LPE
- LegacyHive Windows Zero-Day Exploitation and PoC Disclosure
- LegacyHive Zero-Day Exposes Windows User Profile Service Hive-Loading Flaw
Threats related to LegacyHive: Local Privilege Escalation PoC via Windows User
- LegacyHive: Unpatched Windows User Profile Service (ProfSvc) Local Privilege Escalation Zero-Day — Public PoC Bypasses Fully Patched Systems
- LegacyHive Exploitation Chain Bypasses Windows Security Even With July 2026 Patches Installed
- LegacyHive: Windows 0-Day Local Privilege Escalation via User Profile Service (ProfSvc) Arbitrary Registry Hive Loading
- "LegacyHive" Windows User Profile Service Zero-Day Allows Non-Admin Registry Hive Hijacking
- LegacyHive: Windows 0-Day Allows Standard Users to Load Another User's Registry Hive via User Profile Service
- LegacyHive: Public PoC for Unpatched Windows User Profile Service (ProfSvc) Arbitrary Hive Load Elevation of Privilege (No CVE Assigned)
Detection coverage for TL-2026-1499
As of 2026-07-18, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1499 across Splunk SPL, Microsoft KQL and Sigma, covering 26 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.