# LegacyHive: Local Privilege Escalation PoC via Windows User Profile Service (ProfSvc) Registry Hive Mounting

> Researcher Nightmare Eclipse (alias Chaotic Eclipse) released a stripped-down proof-of-concept named LegacyHive on 2026-07-14/15, hours after Microsoft's July 2026 Patch Tuesday, abusing the Windows User Profile Service (ProfSvc) to mount another user's registry hive (UsrClass.dat) into a low-privileged user's classes root, exposing protected administrative registry data on fully patched Windows 10, 11, and Server systems. No CVE, vendor advisory, or patch exists.

- **Published:** 2026-07-18T00:00:00Z
- **Last reviewed:** 2026-07-18T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1499
- **ID:** TL-2026-1499
- **Severity:** MEDIUM
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Actor:** Nightmare Eclipse
- **Detections:** 9 · **IOCs:** 26 (full data via the Threadlinqs MCP server — Purple tier)

## Description

LegacyHive is an uncoordinated-disclosure local privilege escalation (LPE) technique targeting the Windows User Profile Service (ProfSvc) and the logic it uses to load user registry hives during logon. The exploit chains three mechanisms: offline modification of a registry hive file, Object Manager symbolic link redirection (via undocumented NT APIs NtCreateSymbolicLinkObject and NtCreateDirectoryObjectEx), and opportunistic-lock (oplock)-based synchronization to intercept and redirect the profile-loading sequence. The published technique creates a temporary staging directory with a permissive DACL under C:\ (frequently GUID-named), uses LogonUser/CreateProcessWithLogonW/ImpersonateLoggedOnUser to establish a secondary standard-user logon context, and drives Object Registry (OR*) hive APIs (OROpenHiveByHandle, OROpenKey, ORSetValue, ORSaveHive) together with RegOpenUserClassesRoot to cause a target user's UsrClass.dat hive to end up mounted inside the classes root of a different, lower-privileged user's registry namespace. The result is cross-user hive redirection: a target user's UsrClass.dat (which stores file-association data, shell/Explorer history, COM/shell extension registrations, and application preferences) becomes readable and, per the researcher, writable by an unrelated standard user.

The publicly released PoC is intentionally incomplete. It requires (1) existing code execution as a standard user, (2) valid credentials for a second, unrelated standard-user account, and (3) the target username (an administrator account is the highest-value target) — and in this released form it works only against the usrclass.dat hive rather than the full NTUSER.DAT/UsrClass.dat set the researcher claims a more complete internal version supports. The researcher described the throttled release as deliberately requiring "some brain cells" to weaponize further, and multiple outlets frame the restriction as a response to Microsoft's legal posture toward the researcher's prior disclosures.

LegacyHive functions against all supported Windows 10 and Windows 11 desktop builds and Windows Server 2016/2019/2022, including systems fully patched as of the July 2026 Patch Tuesday, because it exploits a logic/design flaw in hive-loading rather than a specific unpatched code defect. No CVE has been assigned, no Microsoft Security Response Center (MSRC) advisory has been published, and no security update is available; MSRC has stated only that it is "actively investigating the validity" of the report and that the details were not shared with Microsoft prior to publication, which it called a departure from coordinated disclosure that "put[s] our customers at unnecessary risk."

LegacyHive is the ninth uncoordinated Windows zero-day PoC released since April 2026 by the same researcher, following BlueHammer, UnDefend, RedSun, RoguePlanet, YellowKey, GreatXML, GreenPlasma, and MiniPlasma. Some outlets speculate the researcher is a disgruntled former Microsoft engineer and note the pattern is believed to stem from a dispute with Microsoft over its vulnerability-reporting/bug-bounty process; prior releases from the same researcher (BlueHammer, RedSun) reportedly progressed from PoC to widespread exploitation within days of release. Independent analysts assess LegacyHive as "a genuinely useful primitive" for post-compromise lateral movement and credential/data harvesting rather than a standalone initial-access or full-system-compromise exploit, since it presupposes the attacker already has standard-user code execution and a second standard user's credentials. Analysts nonetheless warned that capable adversaries would likely reverse-engineer the withheld components quickly, given no patch or workaround currently exists.

## MITRE ATT&CK

- T1068 Exploitation for Privilege Escalation
- T1134 Access Token Manipulation
- T1112 Modify Registry
- T1547 Boot or Logon Autostart Execution
- T1555 Credentials from Password Stores
- T1552 Unsecured Credentials
- T1083 File and Directory Discovery
- T1033 System Owner/User Discovery
- T1005 Data from Local System
- T1550 Use Alternate Authentication Material
- T1685 Disable or Modify Tools
- T1569 System Services
- T1574 Hijack Execution Flow

## Sources

- [Chaotic Eclipse unveils LegacyHive exploit affecting fully patched Windows systems](https://securityaffairs.com/195418/hacking/chaotic-eclipse-unveils-legacyhive-exploit-affecting-fully-patched-windows-systems.html)
- [Researcher Drops New Windows Zero-Day PoC Hours After Microsoft Patch Tuesday](https://thehackernews.com/2026/07/researcher-drops-new-windows-zero-day.html)
- [LegacyHive: 'Bone-shattering' zero-day from Microsoft's serial tormentor not the haymaker that was promised](https://www.theregister.com/security/2026/07/15/microsofts-serial-tormentor-drops-legacyhive-0-day/5271723)
- [Critical Windows 10, 11, and Server Zero-Day: 'LegacyHive' Exploit Enables Privilege Escalation via User Profile Service Vulnerability](https://www.rescana.com/post/critical-windows-10-11-and-server-zero-day-legacyhive-exploit-enables-privilege-escalation-via-user-profile-service-vuln)
- [Chaotic Eclipse Unveils LegacyHive Exploit Affecting Fully Patched Windows Systems](https://community.opentextcybersecurity.com/vulnerability-vault-228/chaotic-eclipse-unveils-legacyhive-exploit-affecting-fully-patched-windows-systems-365033)
- [LegacyHive Ignites a New Windows Security Storm as Unpatched Zero-Day Challenges Microsoft's Disclosure Policy](https://undercodenews.com/legacyhive-ignites-a-new-windows-security-storm-as-unpatched-zero-day-challenges-microsofts-disclosure-policy-video/)
- [LegacyHive Zero-Day: Windows Privilege Escalation After Patch Tuesday](https://www.it-connect.tech/legacyhive-zero-day-hits-windows-just-after-july-patch-tuesday/)
- [LegacyHive Windows ProfSvc Zero-Day: Detect and Contain LPE](https://windowsforum.com/threads/legacyhive-windows-profsvc-zero-day-detect-and-contain-lpe.439039/)
- [LegacyHive Windows Zero-Day Exploitation and PoC Disclosure](https://detections.ai/intel-exchange/019f61c4-3e00-76ef-98cc-603dc45fae56)
- [LegacyHive Zero-Day Exposes Windows User Profile Service Hive-Loading Flaw](https://www.mallory.ai/stories/019f6463-fdcb-7436-9904-27edd29b9a47)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1499