LegacyHive: Public PoC for Unpatched Windows User Profile Service (ProfSvc) Arbitrary Hive Load Elevation of Privilege (No CVE Assigned)
LegacyHive: Public PoC for Unpatched Windows User Profile (TL-2026-1502), also tracked as LegacyHive, is a high-severity software vulnerability, first published 2026-07-18. It has no confirmed attribution, affects Microsoft Windows User Profile Service (ProfSvc), maps to 16 MITRE ATT&CK techniques (T1005, T1012, T1033), and is covered by 9 detection rules and 22 indicators of compromise.
Key facts for TL-2026-1502
- Threat ID
- TL-2026-1502
- Also known as
- LegacyHive, Windows ProfSvc Arbitrary Hive Load EoP
- Severity
- HIGH
- Status
- ACTIVE
- Category
- VULNERABILITY
- First published
- 2026-07-18
- Last reviewed
- 2026-07-18
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- government administration, finance, health, technology, education, critical-infrastructure, managed-service-providers
- Target regions
- Global, North America, Europe, Asia-Pacific, hong kong
- Detection rules
- 9
- Indicators of compromise
- 22
Malware and tooling in LegacyHive: Public PoC for Unpatched Windows User Profile
Malware and tooling: BlueHammer, GreenPlasma, LegacyHive, RoguePlanet
Researcher Nightmare-Eclipse (aka Chaotic Eclipse) publicly released "LegacyHive," a proof-of-concept exploit abusing the Windows User Profile Service (ProfSvc) to let a standard user mount another user's registry hive — including an administrator's usrclass.dat — under their own classes root, confirmed functional on fully patched Windows systems including the July 2026 cumulative update. No CVE, vendor advisory, or patch exists as of disclosure; Microsoft says it is investigating.
How LegacyHive: Public PoC for Unpatched Windows User Profile works
On 14-15 July 2026, hours after Microsoft's July Patch Tuesday, researcher Nightmare-Eclipse released a public GitHub proof-of-concept named LegacyHive targeting the Windows User Profile Service (profsvc.dll / ProfSvc), the SYSTEM-integrity service responsible for loading a user's registry hive (NTUSER.DAT / UsrClass.dat) at logon. The disclosed technique coerces ProfSvc into loading an attacker-influenced registry hive path, resulting in the target user's UsrClass.dat hive being mounted under the current (attacker) user's HKEY_CLASSES_ROOT. Because HKEY_CLASSES_ROOT governs file-type associations, COM/shell extension registration, and program invocation, an attacker who can mount another (potentially administrator) user's hive gains a powerful primitive: they can read sensitive forensic/application artifacts from that user's profile and, per researcher Will Dormann, modify file-association and COM entries so that when the victim administrator interacts with the system (e.g., opening a file type), attacker-controlled code executes with elevated privileges. Dormann's own demonstration reassociated .txt files to open with calc.exe as a proof of concept for what is trivially extensible to a fully weaponized, no-interaction persistence mechanism.
Technically, community threat-hunting analysis (Kevin Beaumont / Gossi The Dog) of the exploitation chain identifies three concrete sub-behaviors that detection engineering can target: (1) staging of registry hive files (ntuser.dat, usrclass.dat) inside temporary GUID-named directories at the system drive root — a LegacyHive-specific staging technique; (2) redirection of "User Shell Folders" registry values (Local AppData, AppData, Cache, Cookies, History under Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders) away from physical disk paths toward NT device namespace paths such as \\.\globalroot and \BaseNamedObjects, abusing Windows' object-manager namespace to trick ProfSvc into resolving an attacker-controlled hive; and (3) anomalous loading of offreg.dll (the Windows Offline Registry Library) by processes other than the small set of legitimate System32/SysWOW64/WinSxS/Defender binaries that normally use it — a strong masquerading/defense-evasion signal since offreg.dll use outside those trusted paths is highly atypical.
The publicly released PoC is deliberately crippled relative to the original: it requires (1) code execution as a standard user, (2) valid credentials for a second standard user account, and (3) the username of a third target account (which can be an administrator), and it is hard-restricted to the usrclass.dat hive. Nightmare-Eclipse has stated the original, unreleased exploit required no additional credentials and was not limited to any single hive — any registry hive could reportedly be loaded, a materially more severe primitive than what was published. Independent researcher Kevin Beaumont verified the PoC functions and is unpatched, and published a three-part Microsoft Defender for Endpoint (MDE) Advanced Hunting (KQL) detection rule set covering DeviceFileEvents (GUID staging), DeviceRegistryEvents (User Shell Folders redirection to device paths), and DeviceImageLoadEvents (anomalous offreg.dll loads) designed to catch exploitation attempts even against modified/weaponized variants.
The flaw affects "all supported Windows desktop and server versions," and critically was confirmed to still function after installing the July 2026 Patch Tuesday cumulative updates, meaning routine patching does not remediate it. As of the HKCERT/GovCERT.HK High Threat Security Alert (A26-07-26, 16 July 2026), no CVE identifier, affected-version enumeration, or vendor patch has been published; Microsoft's public statement is that it is "actively investigating the validity and potential applicability of these claims." Microsoft has separately signaled prior displeasure with Nightmare-Eclipse's disclosure pattern, previously warning of possible legal action over what it characterized as disclosures causing real harm, even as the company quietly patched several of the researcher's earlier findings (GreenPlasma, MiniPlasma, YellowKey in June 2026; RoguePlanet in July 2026) without public advisories.
Nightmare-Eclipse is a prolific and closely watched Windows/Microsoft-product zero-day researcher with a track record including BlueHammer, RedSun (both escalated from PoC to broader exploitation within days of release), YellowKey and GreenPlasma (BitLocker bypasses), RoguePlanet (Microsoft Defender), MiniPlasma, and UnDefend. Analysts assess that although the public LegacyHive PoC is intentionally hobbled, capable threat actors — particularly post-compromise actors already holding a foothold and a low-privileged account — can straightforwardly reverse-engineer the missing pieces (the credential requirement and the hive-restriction) to build a fully weaponized local privilege escalation tool. Given the primitive does not require any Windows security boundary bypass beyond ProfSvc's hive-loading logic and NT object-manager namespace abuse, defenders should treat this as an active, unpatched local-EoP risk in any environment where standard users may already have a foothold (post-phishing, insider threat, multi-tenant/shared-host, RDS/Citrix/VDI environments) rather than as an internet-facing risk.
MITRE ATT&CK techniques used in TL-2026-1502
Collection
Discovery
T1012 Query Registry; T1033 System Owner/User Discovery; T1087.001 Local Account
Defense Evasion
T1036 Masquerading; T1564 Hide Artifacts; T1574.012 COR_PROFILER
Privilege Escalation
T1068 Exploitation for Privilege Escalation; T1548 Abuse Elevation Control Mechanism
defense-impairment
Execution
Impact
Persistence
T1546.001 Change Default File Association; T1547 Boot or Logon Autostart Execution
Credential Access
T1552 Unsecured Credentials; T1552.002 Credentials in Registry
Affected products and versions in LegacyHive: Public PoC for Unpatched Windows User Profile
- Microsoft — Windows User Profile Service (ProfSvc)
Vulnerable versions: All supported Windows desktop versions (confirmed functional post July 2026 Patch Tuesday); All supported Windows Server versions (confirmed functional post July 2026 Patch Tuesday)
Remediation for LegacyHive: Public PoC for Unpatched Windows User Profile
Patches
- No vendor patch available as of 2026-07-18; Microsoft states it is investigating. July 2026 Patch Tuesday cumulative updates do NOT remediate this issue.
Immediate actions
- Deploy Kevin Beaumont's published three-part Microsoft Defender for Endpoint Advanced Hunting KQL detection rules (GUID-staged hive files, User Shell Folders redirection to \\.\globalroot/\BaseNamedObjects, anomalous offreg.dll loads) for LegacyHive exploitation attempts
- Restrict standard/local user account proliferation and shared-credential use on multi-user hosts (RDS, Citrix, VDI, shared workstations) where this primitive is most exploitable
- Monitor for anomalous User Profile Service (ProfSvc) activity and unexpected registry hive load/mount events targeting other users' UsrClass.dat or NTUSER.DAT files
- Alert on GUID-named directories created at the system drive root containing registry hive files (ntuser.dat, usrclass.dat)
- Alert on offreg.dll being loaded by any process outside System32/SysWOW64/WinSxS/Windows Defender trusted paths
- Audit and tighten file-association and COM/shell-extension registration changes under HKEY_CLASSES_ROOT for anomalies following any suspected exploitation
- Escalate to Microsoft Support / follow MSRC guidance as it becomes available since no vendor patch currently exists
Workarounds
- No official Microsoft workaround published; HKCERT alert directs administrators to follow vendor recommendations once issued
- Limit the number of distinct standard-user accounts able to interactively log on to hosts also used by higher-privileged accounts, pending an official fix
Longer-term hardening
- Deploy EDR/behavioral detection capable of flagging cross-user registry hive loading by non-SYSTEM processes invoking profile-service APIs
- Apply least-privilege / just-in-time admin models so standard users are never co-resident on hosts where domain or local administrators also interactively log on
- Segment and harden shared multi-user environments (RDS/VDI) against local privilege escalation primitives generally
- Track MSRC advisories and apply the eventual official patch as soon as it is released; re-validate fix against the original (non-crippled) technique once details emerge
Weaknesses (CWE) in LegacyHive: Public PoC for Unpatched Windows User Profile
CWE-269, CWE-668
Timeline of LegacyHive: Public PoC for Unpatched Windows User Profile
- Nightmare-Eclipse discloses earlier zero-days (YellowKey, GreenPlasma BitLocker bypasses; MiniPlasma; Windows Defender-related flaw), later patched by Microsoft in June 2026 updates.
- Microsoft ships July 2026 Patch Tuesday cumulative updates (622 fixes reported), which patch Nightmare-Eclipse's earlier RoguePlanet Defender zero-day but do not address the User Profile Service flaw.
- Nightmare-Eclipse (Chaotic Eclipse) publicly releases the LegacyHive proof-of-concept exploit on GitHub, hours after July Patch Tuesday, targeting the Windows User Profile Service arbitrary hive load elevation-of-privilege flaw.
- Analyst Will Dormann publicly demonstrates the file-association hijack primitive by reassociating .txt files to open with calc.exe under a mounted victim hive, illustrating trivial extension to full code execution.
- Security media (The Register, SecurityAffairs, Cybersecurity News, SecurityOnline) publish technical breakdowns of LegacyHive; researcher confirms the public PoC is deliberately restricted to the usrclass.dat hive and requires additional credentials, unlike the original unreleased exploit.
- Kevin Beaumont publishes a three-part MDE Advanced Hunting KQL rule set covering GUID-staged hive files (DeviceFileEvents), User Shell Folders device-path redirection (DeviceRegistryEvents), and anomalous offreg.dll loads (DeviceImageLoadEvents).
- Microsoft states it is "actively investigating the validity and potential applicability of these claims" regarding LegacyHive; no advisory or CVE issued.
- HKCERT/GovCERT.HK publishes High Threat Security Alert A26-07-26 on the Microsoft Windows User Profile Service elevation-of-privilege vulnerability, citing the public LegacyHive PoC; no CVE, affected-version list, or patch is available.
- BleepingComputer, The Hacker News, and additional outlets report LegacyHive grants hackers admin-level registry access; researcher Will Dormann assesses the primitive as "pretty powerful," warning capable attackers can extend it beyond file-association abuse.
- Independent researcher Kevin Beaumont (Gossi The Dog) confirms the LegacyHive PoC functions on unpatched, fully current systems and that his detection queries catch exploitation even if the PoC is modified.
- No CVE, vendor patch, or official mitigation exists; vulnerability remains an active unpatched local elevation-of-privilege risk under active community detection-engineering effort.
Sources cited for LegacyHive: Public PoC for Unpatched Windows User Profile
- High Threat Security Alert (A26-07-26): Vulnerability in Microsoft Windows User Profile Service
- LegacyHive PoC exploit code
- Microsoft Windows User Profile Service Elevation of Privilege Vulnerability
- Researcher Drops New Windows Zero-Day PoC Hours After Microsoft Patch Tuesday
- Chaotic Eclipse Unveils LegacyHive Exploit Affecting Fully Patched Windows Systems
- New LegacyHive Windows 0-day Vulnerability Released by Nightmare-Eclipse With PoC Details
- LegacyHive: 'Bone-shattering' zero-day from Microsoft's serial tormentor not the haymaker that was promised
- LegacyHive: Exploit Code and Full Details Publicly Disclosed for Unpatched Windows Privilege Escalation Flaw
- Critical Windows 10, 11, and Server Zero-Day: 'LegacyHive' Exploit Enables Privilege Escalation via User Profile Service Vulnerability
- New Windows LegacyHive zero-day gives hackers admin privileges
- LegacyHive Windows ProfSvc Zero-Day: Detect and Contain LPE
- Kevin Beaumont (@GossiTheDog) LegacyHive MDE Advanced Hunting detection query
- International Cyber Digest: Nightmare-Eclipse drops LegacyHive Windows privilege-escalation zero-day PoC
- Unpatched Windows Zero-Day Lets Standard Users Hijack Admin Registry Hives
Threats related to LegacyHive: Public PoC for Unpatched Windows User Profile
- LegacyHive: Windows 0-Day Allows Standard Users to Load Another User's Registry Hive via User Profile Service
- LegacyHive: Unpatched Windows User Profile Service (ProfSvc) Local Privilege Escalation Zero-Day — Public PoC Bypasses Fully Patched Systems
- LegacyHive: Local Privilege Escalation PoC via Windows User Profile Service (ProfSvc) Registry Hive Mounting
- "LegacyHive" Windows User Profile Service Zero-Day Allows Non-Admin Registry Hive Hijacking
- LegacyHive: Windows User Profile Service (ProfSvc) Local Privilege Escalation Zero-Day PoC (Unpatched, No CVE)
- Microsoft August 2026 Patch Tuesday: 400 Flaws Fixed, Including Lazarus-Exploited Zero-Day CVE-2026-68820 (AFD.sys) and Two Publicly Disclosed Zero-Days (CVE-2026-62832 "LegacyHive", CVE-2026-72971)
Detection coverage for TL-2026-1502
As of 2026-07-18, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1502 across Splunk SPL, Microsoft KQL and Sigma, covering 22 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.