# LegacyHive: Public PoC for Unpatched Windows User Profile Service (ProfSvc) Arbitrary Hive Load Elevation of Privilege (No CVE Assigned)

> Researcher Nightmare-Eclipse (aka Chaotic Eclipse) publicly released "LegacyHive," a proof-of-concept exploit abusing the Windows User Profile Service (ProfSvc) to let a standard user mount another user's registry hive — including an administrator's usrclass.dat — under their own classes root, confirmed functional on fully patched Windows systems including the July 2026 cumulative update. No CVE, vendor advisory, or patch exists as of disclosure; Microsoft says it is investigating.

- **Published:** 2026-07-18T00:00:00Z
- **Last reviewed:** 2026-07-18T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1502
- **ID:** TL-2026-1502
- **Severity:** HIGH
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 22 (full data via the Threadlinqs MCP server — Purple tier)

## Description

On 14-15 July 2026, hours after Microsoft's July Patch Tuesday, researcher Nightmare-Eclipse released a public GitHub proof-of-concept named LegacyHive targeting the Windows User Profile Service (profsvc.dll / ProfSvc), the SYSTEM-integrity service responsible for loading a user's registry hive (NTUSER.DAT / UsrClass.dat) at logon. The disclosed technique coerces ProfSvc into loading an attacker-influenced registry hive path, resulting in the target user's UsrClass.dat hive being mounted under the current (attacker) user's HKEY_CLASSES_ROOT. Because HKEY_CLASSES_ROOT governs file-type associations, COM/shell extension registration, and program invocation, an attacker who can mount another (potentially administrator) user's hive gains a powerful primitive: they can read sensitive forensic/application artifacts from that user's profile and, per researcher Will Dormann, modify file-association and COM entries so that when the victim administrator interacts with the system (e.g., opening a file type), attacker-controlled code executes with elevated privileges. Dormann's own demonstration reassociated .txt files to open with calc.exe as a proof of concept for what is trivially extensible to a fully weaponized, no-interaction persistence mechanism.

Technically, community threat-hunting analysis (Kevin Beaumont / Gossi The Dog) of the exploitation chain identifies three concrete sub-behaviors that detection engineering can target: (1) staging of registry hive files (ntuser.dat, usrclass.dat) inside temporary GUID-named directories at the system drive root — a LegacyHive-specific staging technique; (2) redirection of "User Shell Folders" registry values (Local AppData, AppData, Cache, Cookies, History under Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders) away from physical disk paths toward NT device namespace paths such as \\.\globalroot and \BaseNamedObjects, abusing Windows' object-manager namespace to trick ProfSvc into resolving an attacker-controlled hive; and (3) anomalous loading of offreg.dll (the Windows Offline Registry Library) by processes other than the small set of legitimate System32/SysWOW64/WinSxS/Defender binaries that normally use it — a strong masquerading/defense-evasion signal since offreg.dll use outside those trusted paths is highly atypical.

The publicly released PoC is deliberately crippled relative to the original: it requires (1) code execution as a standard user, (2) valid credentials for a second standard user account, and (3) the username of a third target account (which can be an administrator), and it is hard-restricted to the usrclass.dat hive. Nightmare-Eclipse has stated the original, unreleased exploit required no additional credentials and was not limited to any single hive — any registry hive could reportedly be loaded, a materially more severe primitive than what was published. Independent researcher Kevin Beaumont verified the PoC functions and is unpatched, and published a three-part Microsoft Defender for Endpoint (MDE) Advanced Hunting (KQL) detection rule set covering DeviceFileEvents (GUID staging), DeviceRegistryEvents (User Shell Folders redirection to device paths), and DeviceImageLoadEvents (anomalous offreg.dll loads) designed to catch exploitation attempts even against modified/weaponized variants.

The flaw affects "all supported Windows desktop and server versions," and critically was confirmed to still function after installing the July 2026 Patch Tuesday cumulative updates, meaning routine patching does not remediate it. As of the HKCERT/GovCERT.HK High Threat Security Alert (A26-07-26, 16 July 2026), no CVE identifier, affected-version enumeration, or vendor patch has been published; Microsoft's public statement is that it is "actively investigating the validity and potential applicability of these claims." Microsoft has separately signaled prior displeasure with Nightmare-Eclipse's disclosure pattern, previously warning of possible legal action over what it characterized as disclosures causing real harm, even as the company quietly patched several of the researcher's earlier findings (GreenPlasma, MiniPlasma, YellowKey in June 2026; RoguePlanet in July 2026) without public advisories.

Nightmare-Eclipse is a prolific and closely watched Windows/Microsoft-product zero-day researcher with a track record including BlueHammer, RedSun (both escalated from PoC to broader exploitation within days of release), YellowKey and GreenPlasma (BitLocker bypasses), RoguePlanet (Microsoft Defender), MiniPlasma, and UnDefend. Analysts assess that although the public LegacyHive PoC is intentionally hobbled, capable threat actors — particularly post-compromise actors already holding a foothold and a low-privileged account — can straightforwardly reverse-engineer the missing pieces (the credential requirement and the hive-restriction) to build a fully weaponized local privilege escalation tool. Given the primitive does not require any Windows security boundary bypass beyond ProfSvc's hive-loading logic and NT object-manager namespace abuse, defenders should treat this as an active, unpatched local-EoP risk in any environment where standard users may already have a foothold (post-phishing, insider threat, multi-tenant/shared-host, RDS/Citrix/VDI environments) rather than as an internet-facing risk.

## MITRE ATT&CK

- T1068 Exploitation for Privilege Escalation
- T1548 Abuse Elevation Control Mechanism
- T1546.001 Change Default File Association
- T1547 Boot or Logon Autostart Execution
- T1574.012 COR_PROFILER
- T1112 Modify Registry
- T1564 Hide Artifacts
- T1036 Masquerading
- T1552 Unsecured Credentials
- T1552.002 Credentials in Registry
- T1087.001 Local Account
- T1033 System Owner/User Discovery
- T1012 Query Registry
- T1005 Data from Local System
- T1204 User Execution
- T1489 Service Stop

## Sources

- [High Threat Security Alert (A26-07-26): Vulnerability in Microsoft Windows User Profile Service](https://www.govcert.gov.hk/en/alerts_detail.php?id=1966)
- [LegacyHive PoC exploit code](https://github.com/MSNightmare/LegacyHive)
- [Microsoft Windows User Profile Service Elevation of Privilege Vulnerability](https://www.hkcert.org/security-bulletin/microsoft-windows-user-profile-service-elevation-of-privilege-vulnerability)
- [Researcher Drops New Windows Zero-Day PoC Hours After Microsoft Patch Tuesday](https://thehackernews.com/2026/07/researcher-drops-new-windows-zero-day.html)
- [Chaotic Eclipse Unveils LegacyHive Exploit Affecting Fully Patched Windows Systems](https://securityaffairs.com/195418/hacking/chaotic-eclipse-unveils-legacyhive-exploit-affecting-fully-patched-windows-systems.html)
- [New LegacyHive Windows 0-day Vulnerability Released by Nightmare-Eclipse With PoC Details](https://cybersecuritynews.com/legacyhive-windows-0-day-vulnerability/)
- [LegacyHive: 'Bone-shattering' zero-day from Microsoft's serial tormentor not the haymaker that was promised](https://www.theregister.com/security/2026/07/15/microsofts-serial-tormentor-drops-legacyhive-0-day/5271723)
- [LegacyHive: Exploit Code and Full Details Publicly Disclosed for Unpatched Windows Privilege Escalation Flaw](https://securityonline.info/legacyhive-windows-exploit/)
- [Critical Windows 10, 11, and Server Zero-Day: 'LegacyHive' Exploit Enables Privilege Escalation via User Profile Service Vulnerability](https://www.rescana.com/post/critical-windows-10-11-and-server-zero-day-legacyhive-exploit-enables-privilege-escalation-via-user-profile-service-vuln)
- [New Windows LegacyHive zero-day gives hackers admin privileges](https://www.bleepingcomputer.com/news/security/new-windows-legacyhive-zero-day-exploit-grants-hackers-admin-access/)
- [LegacyHive Windows ProfSvc Zero-Day: Detect and Contain LPE](https://windowsforum.com/threads/legacyhive-windows-profsvc-zero-day-detect-and-contain-lpe.439039/)
- [Kevin Beaumont (@GossiTheDog) LegacyHive MDE Advanced Hunting detection query](https://github.com/GossiTheDog/ThreatHunting/blob/master/AdvancedHuntingQueries/LegacyHive.kql)
- [International Cyber Digest: Nightmare-Eclipse drops LegacyHive Windows privilege-escalation zero-day PoC](https://x.com/IntCyberDigest/status/2077145793333514593)
- [Unpatched Windows Zero-Day Lets Standard Users Hijack Admin Registry Hives](https://windowsnews.ai/article/unpatched-windows-zero-day-lets-standard-users-hijack-admin-registry-hives.439039)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1502