"LegacyHive" Windows User Profile Service Zero-Day Allows Non-Admin Registry Hive Hijacking

"LegacyHive" Windows User Profile Service Zero-Day Allows (TL-2026-1585), also tracked as LegacyHive, is a high-severity software vulnerability, first published 2026-07-21. It has no confirmed attribution, affects Microsoft Windows 10, maps to 15 MITRE ATT&CK techniques (T1005, T1068, T1070), and is covered by 9 detection rules and 24 indicators of compromise.

Key facts for TL-2026-1585

Threat ID
TL-2026-1585
Also known as
LegacyHive
Severity
HIGH
Status
ACTIVE
Category
VULNERABILITY
First published
2026-07-21
Last reviewed
2026-07-21
Attribution confidence
LOW
Motivation
UNKNOWN
Target sectors
government administration, finance, health, technology, education, managed-service-providers, critical-infrastructure
Target regions
Global
Detection rules
9
Indicators of compromise
24

Malware and tooling in "LegacyHive" Windows User Profile Service Zero-Day Allows

Malware and tooling: LegacyHive PoC (Nightmare-Eclipse)

LegacyHive is an unpatched Windows local-privilege-escalation zero-day in the User Profile Service (profsvc) that lets a standard user abuse a TOCTOU race and symbolic-link redirection to mount another user's (including an administrator's) NTUSER.DAT/UsrClass.dat registry hive with full read/write access, enabling credential/secret theft or malicious registry modification that executes on the victim's next logon. Discovered by researcher Nightmare-Eclipse (aka Chaotic Eclipse) and released publicly on 2026-07-15 with a stripped-down PoC, it affects all currently supported Windows 10/11 and Windows Server builds; no CVE or official Microsoft patch exists, though ACROS Security (0patch) shipped free unofficial micropatches on 2026-07-20 and researcher Kevin Beaumont (GossiTheDog) published Microsoft Defender for Endpoint KQL hunting queries.

How "LegacyHive" Windows User Profile Service Zero-Day Allows works

LegacyHive targets the Windows User Profile Service (profsvc.dll, hosted in svchost.exe), the component responsible for loading a user's registry hive (NTUSER.DAT / UsrClass.dat) during interactive and RDP logon. The root cause is a time-of-check-to-time-of-use (TOCTOU) flaw: when profsvc is asked to mount a hive it first validates access on the target file via CheckFullAccessOnFile, then loads it via the NtLoadKey/NtLoadKey3 API. A non-administrative attacker creates a temporary file/directory under a GUID-named folder at the root of the system drive that they own (passing the initial access check), then — in the narrow window between validation and the actual hive-load call — swaps the target using a symbolic link / reparse-point (NTFS junction) so profsvc's privileged (Local System) load operation is redirected onto a different user's real hive file (e.g. another user's UsrClass.dat or NTUSER.DAT) instead of the attacker's own temp file. Because the load itself executes as Local System, the redirected hive is mounted into the attacker's own HKEY_CLASSES_ROOT / HKEY_CURRENT_USER namespace with full read/write access rather than the intended restricted access. This grants the attacker persistent read/write access to another local user's registry hive, enabling: (1) exfiltration of secrets, application preferences, and forensic artifacts stored in the victim's hive (Explorer history, credentials cached by apps, Cloud/RDP credential blobs, MRU lists), and (2) planting of registry-based persistence/execution primitives (e.g. Shell/Run keys, COM hijack entries, User Shell Folder redirections) that fire the next time the victim (potentially a local administrator) logs on, yielding privilege escalation from standard user to admin/SYSTEM context. The publicly released PoC is deliberately limited by the researcher — it targets only the UsrClass.dat hive and requires the attacker to already know/hold credentials for a second standard user account plus the username of a third (potentially administrative) target account — but the researcher, Nightmare-Eclipse, stated a more complete and reliable exploit chain (including NTUSER.DAT and reduced credential requirements) is feasible with additional engineering. The vulnerability affects Windows 10 (2004 and later, including 20H2/21H1/21H2/22H2), Windows 11 (21H2/22H2/23H2/24H2/25H2), and Windows Server 2019/2022/2025; Windows 7, Server 2008 R2/2012/2012 R2/2016 and pre-2004 Windows 10 builds are not affected. As of disclosure, no CVE identifier has been assigned and Microsoft has only issued a statement acknowledging investigation into the report; no in-the-wild exploitation has been confirmed. ACROS Security's 0patch service released a free unofficial micropatch on 2026-07-20 that enforces token-impersonated NtLoadKey3 calls (never Local System) and falls back to read-only mounting whenever the initial access check fails, closing the race while preserving legitimate use cases such as Mandatory User Profiles. Independent researcher Kevin Beaumont (GossiTheDog) reproduced the exploit and published three Microsoft Defender for Endpoint KQL hunting queries covering: temporary GUID-named directories containing ntuser.dat/usrclass.dat at the drive root; suspicious rewrites of the `Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders` registry key pointing at `\\.\globalroot` or `\BaseNamedObjects` device paths; and anomalous loading of offreg.dll (the Offline Registry library) by processes outside System32/SysWOW64/WinSxS. Nightmare-Eclipse has a track record of high-impact Windows zero-day disclosures, including RoguePlanet, BlueHammer, RedSun, YellowKey, GreenPlasma, MiniPlasma, and UnDefend, several of which reportedly saw rapid real-world exploitation attempts within days of public release, elevating the urgency of defensive hunting and micropatch adoption for LegacyHive despite the absence of confirmed in-the-wild activity so far.

MITRE ATT&CK techniques used in TL-2026-1585

Collection

T1005 Data from Local System

Privilege Escalation

T1068 Exploitation for Privilege Escalation; T1134 Access Token Manipulation

Defense Evasion

T1070 Indicator Removal

Discovery

T1083 File and Directory Discovery; T1087 Account Discovery

defense-impairment

T1112 Modify Registry; T1222 File and Directory Permissions Modification

Execution

T1204 User Execution

Persistence

T1546 Event Triggered Execution; T1547 Boot or Logon Autostart Execution

Credential Access

T1552 Unsecured Credentials; T1555 Credentials from Password Stores

Impact

T1565 Data Manipulation

stealth

T1574 Hijack Execution Flow

Affected products and versions in "LegacyHive" Windows User Profile Service Zero-Day Allows

  • Microsoft — Windows 10
    Vulnerable versions: 2004; 20H2; 21H1; 21H2; 22H2
  • Microsoft — Windows 11
    Vulnerable versions: 21H2; 22H2; 23H2; 24H2; 25H2
  • Microsoft — Windows Server
    Vulnerable versions: 2019; 2022; 2025

Remediation for "LegacyHive" Windows User Profile Service Zero-Day Allows

Patches

  • No official Microsoft patch/KB available as of 2026-07-21; Microsoft has stated it is investigating
  • ACROS Security 0patch unofficial micropatch (released 2026-07-20) enforces impersonated NtLoadKey3 and read-only fallback on failed access checks

Immediate actions

  • Deploy ACROS Security (0patch) free unofficial micropatch for LegacyHive on all affected Windows 10/11 and Windows Server endpoints
  • Deploy Kevin Beaumont's (GossiTheDog) Microsoft Defender for Endpoint LegacyHive KQL hunting queries and run retroactive hunts across endpoint telemetry
  • Restrict local standard-user account creation and interactive logon rights on shared/multi-user and RDP session host systems where feasible
  • Alert on creation of GUID-named directories at the root of the system drive containing ntuser.dat or usrclass.dat files
  • Alert on modification of HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders values referencing \\.\globalroot or \BaseNamedObjects device paths
  • Alert on offreg.dll being loaded by processes outside System32/SysWOW64/WinSxS (excluding known Windows Defender install paths)

Workarounds

  • Limit standard-user account provisioning and shared-workstation/RDP multi-user access where operationally possible
  • Monitor and restrict creation of arbitrary directories/junctions at the root of the system drive by non-administrative users

Longer-term hardening

  • Apply Microsoft's official patch once released and remove the 0patch micropatch per vendor guidance
  • Harden multi-user/RDP session hosts to minimize standard-user local logon where not operationally required
  • Deploy EDR behavioral detection tuned to registry hive load/redirection abuse and symbolic-link/reparse-point manipulation
  • Track Nightmare-Eclipse's public disclosure history and proactively evaluate/micropatch future Windows zero-days from this researcher

Weaknesses (CWE) in "LegacyHive" Windows User Profile Service Zero-Day Allows

CWE-367, CWE-59, CWE-284, CWE-269

Timeline of "LegacyHive" Windows User Profile Service Zero-Day Allows

  • Microsoft ships July 2026 Patch Tuesday, addressing over 600 CVEs across its product line.
  • 0patch/ACROS Security account places LegacyHive's internal discovery roughly six days prior to the 2026-07-20 micropatch release, placing initial identification of the User Profile Service TOCTOU flaw around this date.
  • Researcher Nightmare-Eclipse (aka Chaotic Eclipse) discloses the LegacyHive vulnerability in the Windows User Profile Service.
  • Independent researcher Kevin Beaumont (GossiTheDog) reproduces the exploit and publishes three Microsoft Defender for Endpoint KQL hunting queries to GitHub (DeviceFileEvents, DeviceRegistryEvents, DeviceImageLoadEvents) targeting LegacyHive exploitation artifacts.
  • Nightmare-Eclipse publicly releases a stripped-down proof-of-concept exploit for LegacyHive on GitHub, hours after Microsoft's Patch Tuesday release; the PoC accepts three arguments (helper account, helper account password, target user), creates a permissive-DACL GUID-named temp directory under C:\, and uses an oplock to pause hive loading and swap the target path via Object Manager symbolic links before the privileged load executes; media coverage begins (The Register, The Hacker News, Security Affairs, ThreatLocker, Cybernews, SecurityOnline, Rescana, IT-Connect, CyberSecurityNews).
  • Microsoft issues a statement acknowledging it is aware of the reported vulnerability and is investigating its validity and applicability, and reaffirms support for coordinated vulnerability disclosure.
  • ThreatLocker publishes a video demonstration and technical write-up of the LegacyHive exploit, detailing the NtCreateDirectoryObjectEx/NtCreateSymbolicLinkObject redirection chain and CreateProcessWithLogonW trigger path.
  • ACROS Security releases a free unofficial 0patch micropatch for LegacyHive, enforcing impersonated NtLoadKey3 calls (rather than unimpersonated NtLoadKeyEx) and read-only fallback mounting on failed access checks, across Windows 10 2004+ through Windows 11 25H2 and Windows Server 2019/2022/2025.
  • BleepingComputer publishes coverage of the 0patch micropatch release, driving broader SOC/defender awareness of LegacyHive; no CVE has been assigned and no in-the-wild exploitation is confirmed as of this date.

Sources cited for "LegacyHive" Windows User Profile Service Zero-Day Allows

Threats related to "LegacyHive" Windows User Profile Service Zero-Day Allows

Detection coverage for TL-2026-1585

As of 2026-07-21, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1585 across Splunk SPL, Microsoft KQL and Sigma, covering 24 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats