LegacyHive Exploitation Chain Bypasses Windows Security Even With July 2026 Patches Installed
LegacyHive Exploitation Chain Bypasses Windows Security Even (TL-2026-1742), also tracked as LegacyHive, is a high-severity software vulnerability, first published 2026-07-28. It is attributed to Nightmare Eclipse with high confidence, affects Microsoft Windows User Profile Service (ProfSvc), maps to 14 MITRE ATT&CK techniques (T1005, T1012, T1036), and is covered by 9 detection rules and 34 indicators of compromise.
Key facts for TL-2026-1742
- Threat ID
- TL-2026-1742
- Also known as
- LegacyHive, ProfSvc Arbitrary Hive Load
- Severity
- HIGH
- Status
- ACTIVE
- Category
- VULNERABILITY
- First published
- 2026-07-28
- Last reviewed
- 2026-07-28
- Attribution
- Nightmare Eclipse
- Attribution confidence
- HIGH
- Motivation
- UNKNOWN
- Detection rules
- 9
- Indicators of compromise
- 34
Malware and tooling in LegacyHive Exploitation Chain Bypasses Windows Security Even
Malware and tooling: RoguePlanet (CVE-2026-50656), 0patch, LegacyHive, ThreatLocker Policy TL.EV.1827 (Malware (Defender: LegacyHive))
LegacyHive is a publicly disclosed, unpatched Windows local privilege-escalation exploit chain that lets a standard, non-admin user mount another user's registry hive (UsrClass.dat) with full access by chaining offline registry-hive tampering, NT Object Manager symbolic-link redirection, and an oplock-timed TOCTOU race in the Windows User Profile Service (ProfSvc). No CVE or official Microsoft patch exists; only a third-party 0patch micropatch mitigates it.
How LegacyHive Exploitation Chain Bypasses Windows Security Even works
LegacyHive, disclosed on 2026-07-14 by the researcher known as Nightmare-Eclipse (aka Chaotic Eclipse / MSNightmare), abuses the Windows User Profile Service (ProfSvc) rather than a memory-corruption bug or an unpatched CVE. The attacker creates a GUID-named staging directory under C:\ with a permissive DACL (GENERIC_ALL to Everyone) containing decoy copies of ntuser.dat and UsrClass.dat, then resolves the undocumented native APIs NtCreateSymbolicLinkObject and NtCreateDirectoryObjectEx from ntdll.dll to build a chain of NT Object Manager directories and symbolic links under \BaseNamedObjects\Restricted. Using the Offline Registry Library (OROpenHiveByHandle/OROpenKey/ORSetValue/ORSaveHive), the attacker offline-modifies a secondary standard user's ntuser.dat so its HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\Local AppData value points into the crafted Object Manager namespace instead of the filesystem. The attacker then authenticates as the secondary user (LogonUser / ImpersonateLoggedOnUser) and invokes CreateProcessWithLogonW with LOGON_WITH_PROFILE, causing ProfSvc to begin loading that user's profile. A batch opportunistic lock (oplock) is placed on the decoy UsrClass.dat to pause ProfSvc mid-resolution; during this window the attacker swaps the symbolic-link target from the decoy directory to the actual target user's profile directory (a TOCTOU race), so that when the oplock releases, ProfSvc loads the target user's real UsrClass.dat hive and mounts it — with full read/write access — under the attacker's own HKU\<SID>_Classes namespace. The result is silent cross-account access to another user's stored secrets, application configuration, Windows Explorer history, and forensic artifacts, and per ACROS Security's own description, potential ability to modify registry values so that attacker code executes the next time the victim logs in. The public PoC (github.com/MSNightmare/LegacyHive, LegacyHive.exe/LegacyHive.cpp) was intentionally stripped down by the researcher to require credentials for an additional standard user account and to only support the UsrClass.dat hive, reportedly to reduce the risk of mass abuse; the researcher states a more complete, credential-less variant capable of mounting arbitrary hives exists but was withheld. The technique was confirmed functional on fully patched Windows 10 (2004+), Windows 11 (23H2/24H2), and Windows Server 2016/2019/2022/2025 running the July 2026 Patch Tuesday updates, and was independently reproduced by multiple researchers as well as LevelBlue's OpsIntel CTI and Threat Operations and Research (THOR) groups. Microsoft acknowledged the report and stated it was investigating; as of 2026-07-28 no CVE has been assigned and no official patch exists — the only available mitigation is a free third-party micropatch from ACROS Security's 0patch platform (available 2026-07-20 for Windows 10 2004+ and Windows Server 2022+) that redirects the exploit to a temporary, low-value profile hive. The same researcher publicly disclosed a related, already-patched Windows privilege-escalation zero-day one month earlier — RoguePlanet (CVE-2026-50656), a TOCTOU race condition in Microsoft Defender's file-handling/quarantine logic that let a low-privileged user obtain a SYSTEM-level cmd.exe, patched by Microsoft on 2026-07-09 — establishing a pattern of TOCTOU/link-resolution research against core Windows components. Because LegacyHive is local and post-compromise (it requires prior interactive access and the credentials of a secondary standard-user account), it functions as a privilege-escalation and credential/secrets-harvesting primitive rather than a remote intrusion vector, but security teams note it is an attractive building block for APT and ransomware operators seeking to escalate from a standard foothold to administrator-equivalent access without triggering signature-based defenses.
MITRE ATT&CK techniques used in TL-2026-1742
Collection
Discovery
Defense Evasion
T1036 Masquerading; T1078 Valid Accounts; T1134 Access Token Manipulation; T1574 Hijack Execution Flow
Privilege Escalation
T1068 Exploitation for Privilege Escalation; T1078 Valid Accounts; T1134 Access Token Manipulation
Execution
defense-impairment
T1112 Modify Registry; T1222 File and Directory Permissions Modification
Persistence
T1547 Boot or Logon Autostart Execution
Credential Access
T1552 Unsecured Credentials; T1555 Credentials from Password Stores
Resource Development
Affected products and versions in LegacyHive Exploitation Chain Bypasses Windows Security Even
- Microsoft — Windows User Profile Service (ProfSvc)
Vulnerable versions: Windows 10 2004 and later (including July 2026 cumulative updates); Windows 11 23H2; Windows 11 24H2; Windows Server 2016; Windows Server 2019; Windows Server 2022; Windows Server 2025
Fixed in: None official (no Microsoft patch or CVE as of 2026-07-28); 0patch micropatch (ACROS Security) available for Windows 10 2004+ and Windows Server 2022+
Remediation for LegacyHive Exploitation Chain Bypasses Windows Security Even
Patches
- No official Microsoft patch or CVE exists as of 2026-07-28; Microsoft has stated it is investigating the report.
- 0patch (ACROS Security) unofficial micropatch available since 2026-07-20; redirects exploit attempts to a temporary profile hive instead of a real administrator hive.
Immediate actions
- Apply the free 0patch micropatch from ACROS Security (available for Windows 10 2004+ and Windows Server 2022+) pending an official Microsoft fix.
- Deploy behavioral detection for CreateProcessWithLogonW calls using LOGON_WITH_PROFILE combined with CREATE_SUSPENDED launches of common Windows binaries (e.g. notepad.exe) under a different SID.
- Alert on NtCreateSymbolicLinkObject / NtCreateDirectoryObjectEx calls creating objects beneath \BaseNamedObjects\Restricted by non-SYSTEM, user-context processes.
- Monitor Windows Security Event IDs 4648, 4624, 4688, 4663, and 4657 for hive-access and registry-modification anomalies tied to ntuser.dat / UsrClass.dat outside standard profile paths.
Workarounds
- Restrict or closely monitor use of secondary/helper standard-user accounts on systems where hive redirection would be high-impact.
- Audit and tighten DACLs on temporary/staging directories created under C:\ to prevent GENERIC_ALL grants to Everyone.
Longer-term hardening
- Enable Credential Guard to reduce the value of credential material harvested from mounted foreign hives.
- Deploy LAPS or unique per-machine local administrator passwords to reduce the blast radius of cross-user hive access.
- Restrict interactive logon rights for standard/secondary accounts on sensitive or privileged systems.
- Deploy Sysmon (Event IDs 11, 12, 13) plus SIEM correlation rules for hive-file creation outside C:\Users\<username>\ and for Local AppData shell-folder path tampering.
Weaknesses (CWE) in LegacyHive Exploitation Chain Bypasses Windows Security Even
CWE-367, CWE-59, CWE-732, CWE-269
Timeline of LegacyHive Exploitation Chain Bypasses Windows Security Even
- Nightmare-Eclipse publicly discloses CVE-2026-50656 ('RoguePlanet'), a TOCTOU race condition in Microsoft Defender's file-handling/quarantine logic enabling SYSTEM-level privilege escalation — the same researcher's prior zero-day and a technical precursor to LegacyHive's TOCTOU approach.
- Microsoft ships a Malware Protection Engine update fixing CVE-2026-50656 (RoguePlanet).
- Microsoft states it 'is aware of the reported vulnerability and is actively investigating the validity and potential applicability of these claims.'
- Nightmare-Eclipse (aka Chaotic Eclipse / MSNightmare) publicly releases the LegacyHive technical writeup and a stripped-down PoC (github.com/MSNightmare/LegacyHive) hours after Patch Tuesday, demonstrating the exploit works on fully patched Windows 10, Windows 11, and Windows Server 2016-2025.
- Microsoft releases the July 2026 Patch Tuesday cumulative updates, addressing 600+ CVEs across the Windows ecosystem.
- ThreatLocker publishes a video demo and technical analysis of LegacyHive and adds detection policy TL.EV.1827 ('Malware (Defender: LegacyHive)').
- Cyderes' Howler Cell and independent researcher Chen Aviani publish detailed technical breakdowns including behavioral detection indicators and MITRE ATT&CK mappings.
- ACROS Security (0patch) ships a free unofficial micropatch for Windows 10 2004+ and Windows Server 2022+ that redirects the exploit to a temporary profile hive, neutralizing the attack pending an official Microsoft fix.
- Follow-on reporting (PurpleSec, Rescana) confirms no CVE identifier or official Microsoft patch has been issued; the vulnerability remains functional on all fully patched, supported Windows desktop and server versions.
- Cyber Security News reports that LevelBlue's OpsIntel CTI and Threat Operations and Research (THOR) groups independently reproduced the exploit chain, prompting this threat's addition to tracking.
Sources cited for LegacyHive Exploitation Chain Bypasses Windows Security Even
- LegacyHive Exploitation Chain Bypasses Windows Security Even With July 2026 Patches Installed
- Researcher Drops New Windows Zero-Day PoC Hours After Microsoft Patch Tuesday
- LegacyHive: Video demo and analysis of Windows 0-day from NightmareEclipse
- LegacyHive: The Windows Zero-Day That Loads Another User's Registry Hive
- Windows User Profile Service Arbitrary Hive Loading Vulnerability
- Critical Windows 10, 11, and Server Zero-Day: 'LegacyHive' Exploit Enables Privilege Escalation via User Profile Service Vulnerability
- Breaking Down LegacyHive
- MSNightmare/LegacyHive PoC repository
- Windows LegacyHive zero-day flaw gets free, unofficial patches
- CVE-2026-50656: Microsoft Defender RoguePlanet Zero-Day Enables Local Privilege Escalation on Fully Patched Windows 10 & 11 Systems
- Microsoft releases fix for RoguePlanet Defender flaw (CVE-2026-50656)
- Microsoft Patches RoguePlanet Defender Flaw That Can Grant SYSTEM Privileges
Threats related to LegacyHive Exploitation Chain Bypasses Windows Security Even
- LegacyHive: Local Privilege Escalation PoC via Windows User Profile Service (ProfSvc) Registry Hive Mounting
- LegacyHive: Windows 0-Day Local Privilege Escalation via User Profile Service (ProfSvc) Arbitrary Registry Hive Loading
- LegacyHive: Windows 0-Day Allows Standard Users to Load Another User's Registry Hive via User Profile Service
- "LegacyHive" Windows User Profile Service Zero-Day Allows Non-Admin Registry Hive Hijacking
- CVE-2026-50656: RoguePlanet Microsoft Defender Zero-Day Local Privilege Escalation (Malware Protection Engine TOCTOU)
- Schneider Electric Floating License Manager - CVE-2024-2658 Local Privilege Escalation via Uncontrolled Search Path in FlexNet Publisher
Detection coverage for TL-2026-1742
As of 2026-07-28, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1742 across Splunk SPL, Microsoft KQL and Sigma, covering 34 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.