# LegacyHive Exploitation Chain Bypasses Windows Security Even With July 2026 Patches Installed

> LegacyHive is a publicly disclosed, unpatched Windows local privilege-escalation exploit chain that lets a standard, non-admin user mount another user's registry hive (UsrClass.dat) with full access by chaining offline registry-hive tampering, NT Object Manager symbolic-link redirection, and an oplock-timed TOCTOU race in the Windows User Profile Service (ProfSvc). No CVE or official Microsoft patch exists; only a third-party 0patch micropatch mitigates it.

- **Published:** 2026-07-28T00:00:00Z
- **Last reviewed:** 2026-07-28T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1742
- **ID:** TL-2026-1742
- **Severity:** HIGH
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Actor:** Nightmare Eclipse
- **Detections:** 9 · **IOCs:** 34 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-50656

## Description

LegacyHive, disclosed on 2026-07-14 by the researcher known as Nightmare-Eclipse (aka Chaotic Eclipse / MSNightmare), abuses the Windows User Profile Service (ProfSvc) rather than a memory-corruption bug or an unpatched CVE. The attacker creates a GUID-named staging directory under C:\ with a permissive DACL (GENERIC_ALL to Everyone) containing decoy copies of ntuser.dat and UsrClass.dat, then resolves the undocumented native APIs NtCreateSymbolicLinkObject and NtCreateDirectoryObjectEx from ntdll.dll to build a chain of NT Object Manager directories and symbolic links under \BaseNamedObjects\Restricted. Using the Offline Registry Library (OROpenHiveByHandle/OROpenKey/ORSetValue/ORSaveHive), the attacker offline-modifies a secondary standard user's ntuser.dat so its HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\Local AppData value points into the crafted Object Manager namespace instead of the filesystem. The attacker then authenticates as the secondary user (LogonUser / ImpersonateLoggedOnUser) and invokes CreateProcessWithLogonW with LOGON_WITH_PROFILE, causing ProfSvc to begin loading that user's profile. A batch opportunistic lock (oplock) is placed on the decoy UsrClass.dat to pause ProfSvc mid-resolution; during this window the attacker swaps the symbolic-link target from the decoy directory to the actual target user's profile directory (a TOCTOU race), so that when the oplock releases, ProfSvc loads the target user's real UsrClass.dat hive and mounts it — with full read/write access — under the attacker's own HKU\<SID>_Classes namespace. The result is silent cross-account access to another user's stored secrets, application configuration, Windows Explorer history, and forensic artifacts, and per ACROS Security's own description, potential ability to modify registry values so that attacker code executes the next time the victim logs in. The public PoC (github.com/MSNightmare/LegacyHive, LegacyHive.exe/LegacyHive.cpp) was intentionally stripped down by the researcher to require credentials for an additional standard user account and to only support the UsrClass.dat hive, reportedly to reduce the risk of mass abuse; the researcher states a more complete, credential-less variant capable of mounting arbitrary hives exists but was withheld. The technique was confirmed functional on fully patched Windows 10 (2004+), Windows 11 (23H2/24H2), and Windows Server 2016/2019/2022/2025 running the July 2026 Patch Tuesday updates, and was independently reproduced by multiple researchers as well as LevelBlue's OpsIntel CTI and Threat Operations and Research (THOR) groups. Microsoft acknowledged the report and stated it was investigating; as of 2026-07-28 no CVE has been assigned and no official patch exists — the only available mitigation is a free third-party micropatch from ACROS Security's 0patch platform (available 2026-07-20 for Windows 10 2004+ and Windows Server 2022+) that redirects the exploit to a temporary, low-value profile hive. The same researcher publicly disclosed a related, already-patched Windows privilege-escalation zero-day one month earlier — RoguePlanet (CVE-2026-50656), a TOCTOU race condition in Microsoft Defender's file-handling/quarantine logic that let a low-privileged user obtain a SYSTEM-level cmd.exe, patched by Microsoft on 2026-07-09 — establishing a pattern of TOCTOU/link-resolution research against core Windows components. Because LegacyHive is local and post-compromise (it requires prior interactive access and the credentials of a secondary standard-user account), it functions as a privilege-escalation and credential/secrets-harvesting primitive rather than a remote intrusion vector, but security teams note it is an attractive building block for APT and ransomware operators seeking to escalate from a standard foothold to administrator-equivalent access without triggering signature-based defenses.

## MITRE ATT&CK

- T1588 Obtain Capabilities
- T1078 Valid Accounts
- T1068 Exploitation for Privilege Escalation
- T1106 Native API
- T1134 Access Token Manipulation
- T1036 Masquerading
- T1112 Modify Registry
- T1222 File and Directory Permissions Modification
- T1574 Hijack Execution Flow
- T1552 Unsecured Credentials
- T1555 Credentials from Password Stores
- T1012 Query Registry
- T1005 Data from Local System
- T1547 Boot or Logon Autostart Execution
- T1134 Access Token Manipulation
- T1078 Valid Accounts

## Sources

- [LegacyHive Exploitation Chain Bypasses Windows Security Even With July 2026 Patches Installed](https://cybersecuritynews.com/legacyhive-exploitation-chain/)
- [Researcher Drops New Windows Zero-Day PoC Hours After Microsoft Patch Tuesday](https://thehackernews.com/2026/07/researcher-drops-new-windows-zero-day.html)
- [LegacyHive: Video demo and analysis of Windows 0-day from NightmareEclipse](https://www.threatlocker.com/blog/legacyhive-video-demo-and-analysis-of-windows-0-day-from-nightmareeclipse)
- [LegacyHive: The Windows Zero-Day That Loads Another User's Registry Hive](https://purplesec.org/blog/legacyhive-windows-zero-day/)
- [Windows User Profile Service Arbitrary Hive Loading Vulnerability](https://www.cyderes.com/howler-cell/legacyhive-windows-user-profile-loading-vulnerability)
- [Critical Windows 10, 11, and Server Zero-Day: 'LegacyHive' Exploit Enables Privilege Escalation via User Profile Service Vulnerability](https://www.rescana.com/post/critical-windows-10-11-and-server-zero-day-legacyhive-exploit-enables-privilege-escalation-via-user-profile-service-vuln)
- [Breaking Down LegacyHive](https://medium.com/@avianichen/breaking-down-legacyhive-b85d6464a3fe)
- [MSNightmare/LegacyHive PoC repository](https://github.com/MSNightmare/LegacyHive)
- [Windows LegacyHive zero-day flaw gets free, unofficial patches](https://www.bleepingcomputer.com/news/security/windows-legacyhive-zero-day-flaw-gets-free-unofficial-patches/)
- [CVE-2026-50656: Microsoft Defender RoguePlanet Zero-Day Enables Local Privilege Escalation on Fully Patched Windows 10 & 11 Systems](https://www.rescana.com/post/cve-2026-50656-microsoft-defender-rogueplanet-zero-day-enables-local-privilege-escalation-on-fully-patched-windows-10-11)
- [Microsoft releases fix for RoguePlanet Defender flaw (CVE-2026-50656)](https://www.helpnetsecurity.com/2026/07/09/microsoft-releases-fix-for-rogueplanet-defender-flaw-cve-2026-50656/)
- [Microsoft Patches RoguePlanet Defender Flaw That Can Grant SYSTEM Privileges](https://thehackernews.com/2026/07/microsoft-patches-rogueplanet-defender.html)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1742