# "LegacyHive" Windows User Profile Service Zero-Day Allows Non-Admin Registry Hive Hijacking

> LegacyHive is an unpatched Windows local-privilege-escalation zero-day in the User Profile Service (profsvc) that lets a standard user abuse a TOCTOU race and symbolic-link redirection to mount another user's (including an administrator's) NTUSER.DAT/UsrClass.dat registry hive with full read/write access, enabling credential/secret theft or malicious registry modification that executes on the victim's next logon. Discovered by researcher Nightmare-Eclipse (aka Chaotic Eclipse) and released publicly on 2026-07-15 with a stripped-down PoC, it affects all currently supported Windows 10/11 and Windows Server builds; no CVE or official Microsoft patch exists, though ACROS Security (0patch) shipped free unofficial micropatches on 2026-07-20 and researcher Kevin Beaumont (GossiTheDog) published Microsoft Defender for Endpoint KQL hunting queries.

- **Published:** 2026-07-21T00:00:00Z
- **Last reviewed:** 2026-07-21T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1585
- **ID:** TL-2026-1585
- **Severity:** HIGH
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 24 (full data via the Threadlinqs MCP server — Purple tier)

## Description

LegacyHive targets the Windows User Profile Service (profsvc.dll, hosted in svchost.exe), the component responsible for loading a user's registry hive (NTUSER.DAT / UsrClass.dat) during interactive and RDP logon. The root cause is a time-of-check-to-time-of-use (TOCTOU) flaw: when profsvc is asked to mount a hive it first validates access on the target file via CheckFullAccessOnFile, then loads it via the NtLoadKey/NtLoadKey3 API. A non-administrative attacker creates a temporary file/directory under a GUID-named folder at the root of the system drive that they own (passing the initial access check), then — in the narrow window between validation and the actual hive-load call — swaps the target using a symbolic link / reparse-point (NTFS junction) so profsvc's privileged (Local System) load operation is redirected onto a different user's real hive file (e.g. another user's UsrClass.dat or NTUSER.DAT) instead of the attacker's own temp file. Because the load itself executes as Local System, the redirected hive is mounted into the attacker's own HKEY_CLASSES_ROOT / HKEY_CURRENT_USER namespace with full read/write access rather than the intended restricted access. This grants the attacker persistent read/write access to another local user's registry hive, enabling: (1) exfiltration of secrets, application preferences, and forensic artifacts stored in the victim's hive (Explorer history, credentials cached by apps, Cloud/RDP credential blobs, MRU lists), and (2) planting of registry-based persistence/execution primitives (e.g. Shell/Run keys, COM hijack entries, User Shell Folder redirections) that fire the next time the victim (potentially a local administrator) logs on, yielding privilege escalation from standard user to admin/SYSTEM context. The publicly released PoC is deliberately limited by the researcher — it targets only the UsrClass.dat hive and requires the attacker to already know/hold credentials for a second standard user account plus the username of a third (potentially administrative) target account — but the researcher, Nightmare-Eclipse, stated a more complete and reliable exploit chain (including NTUSER.DAT and reduced credential requirements) is feasible with additional engineering. The vulnerability affects Windows 10 (2004 and later, including 20H2/21H1/21H2/22H2), Windows 11 (21H2/22H2/23H2/24H2/25H2), and Windows Server 2019/2022/2025; Windows 7, Server 2008 R2/2012/2012 R2/2016 and pre-2004 Windows 10 builds are not affected. As of disclosure, no CVE identifier has been assigned and Microsoft has only issued a statement acknowledging investigation into the report; no in-the-wild exploitation has been confirmed. ACROS Security's 0patch service released a free unofficial micropatch on 2026-07-20 that enforces token-impersonated NtLoadKey3 calls (never Local System) and falls back to read-only mounting whenever the initial access check fails, closing the race while preserving legitimate use cases such as Mandatory User Profiles. Independent researcher Kevin Beaumont (GossiTheDog) reproduced the exploit and published three Microsoft Defender for Endpoint KQL hunting queries covering: temporary GUID-named directories containing ntuser.dat/usrclass.dat at the drive root; suspicious rewrites of the `Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders` registry key pointing at `\\.\globalroot` or `\BaseNamedObjects` device paths; and anomalous loading of offreg.dll (the Offline Registry library) by processes outside System32/SysWOW64/WinSxS. Nightmare-Eclipse has a track record of high-impact Windows zero-day disclosures, including RoguePlanet, BlueHammer, RedSun, YellowKey, GreenPlasma, MiniPlasma, and UnDefend, several of which reportedly saw rapid real-world exploitation attempts within days of public release, elevating the urgency of defensive hunting and micropatch adoption for LegacyHive despite the absence of confirmed in-the-wild activity so far.

## MITRE ATT&CK

- T1068 Exploitation for Privilege Escalation
- T1134 Access Token Manipulation
- T1555 Credentials from Password Stores
- T1552 Unsecured Credentials
- T1112 Modify Registry
- T1070 Indicator Removal
- T1547 Boot or Logon Autostart Execution
- T1546 Event Triggered Execution
- T1574 Hijack Execution Flow
- T1204 User Execution
- T1083 File and Directory Discovery
- T1087 Account Discovery
- T1005 Data from Local System
- T1565 Data Manipulation
- T1222 File and Directory Permissions Modification

## Sources

- [Windows LegacyHive zero-day flaw gets free, unofficial patches](https://www.bleepingcomputer.com/news/security/windows-legacyhive-zero-day-flaw-gets-free-unofficial-patches/)
- [Micropatches Available for LegacyHive (Windows User Profile Service Elevation of Privilege)](https://0patch.com/blog/micropatches-available-for-legacyhive-windows-user-profile-service-elevation-of-p)
- [LegacyHive Advanced Hunting KQL Queries](https://github.com/GossiTheDog/ThreatHunting/blob/master/AdvancedHuntingQueries/LegacyHive.kql)
- [LegacyHive: 'Bone-shattering' zero-day from Microsoft's serial tormentor not the haymaker that was promised](https://www.theregister.com/security/2026/07/15/microsofts-serial-tormentor-drops-legacyhive-0-day/5271723)
- [Researcher Drops New Windows Zero-Day PoC Hours After Microsoft Patch Tuesday](https://thehackernews.com/2026/07/researcher-drops-new-windows-zero-day.html)
- [Chaotic Eclipse Unveils LegacyHive Exploit Affecting Fully Patched Windows Systems](https://securityaffairs.com/195418/hacking/chaotic-eclipse-unveils-legacyhive-exploit-affecting-fully-patched-windows-systems.html)
- [LegacyHive: Exploit Code and Full Details Publicly Disclosed for Unpatched Windows Privilege Escalation Flaw](https://securityonline.info/legacyhive-windows-exploit/)
- [Critical Windows 10, 11, and Server Zero-Day: 'LegacyHive' Exploit Enables Privilege Escalation via User Profile Service Vulnerability](https://www.rescana.com/post/critical-windows-10-11-and-server-zero-day-legacyhive-exploit-enables-privilege-escalation-via-user-profile-service-vuln)
- [LegacyHive: Video demo and analysis of Windows 0-day from NightmareEclipse](https://www.threatlocker.com/blog/legacyhive-video-demo-and-analysis-of-windows-0-day-from-nightmareeclipse)
- [LegacyHive Zero-Day: Windows Privilege Escalation After Patch Tuesday](https://www.it-connect.tech/legacyhive-zero-day-hits-windows-just-after-july-patch-tuesday/)
- [Nightmare Eclipse drops new Windows privilege escalation vulnerability](https://cybernews.com/security/nightmare-eclipse-windows-legacyhive-privilege-escalation-bug/)
- [New LegacyHive Windows 0-day Vulnerability Released by Nightmare-Eclipse With PoC Details](https://cybersecuritynews.com/legacyhive-windows-0-day-vulnerability/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1585