LegacyHive Windows Zero-Day Disclosed: ProfSvc Registry Hive Load Flaw, No Patch
Researcher Nightmare Eclipse disclosed the LegacyHive Windows zero-day the day after Microsoft July Patch Tuesday. The flaw hits Windows User Profile Service, enables LPE to SYSTEM, and currently has no CVE, no official patch, and a public PoC.
On 2026-07-15, ~30 minutes after Microsoft July Patch Tuesday, researcher Nightmare Eclipse (aka Chaotic Eclipse, MSNightmare) disclosed an unpatched Windows LPE: LegacyHive. Affects all currently supported Windows desktop and server versions, including fully patched systems. No CVE. No official patch. Public PoC exists.
Incident overview
LegacyHive is Nightmare Eclipse's sixth public Windows zero-day since 2026-04. Prior disclosures include BlueHammer, RedSun, and UnDefend. Three Microsoft Defender bugs were exploited in the wild after disclosure and added to the CISA KEV catalog.
Target is Windows User Profile Service (ProfSvc), a SYSTEM service that handles user environment configuration and registry hive load.
Technical details
How it works
LegacyHive abuses a ProfSvc logic flaw during registry hive load. On logon, Windows loads `NTUSER.DAT` and `UsrClass.dat` from trusted paths under the user profile directory. The chain below causes ProfSvc to load an attacker-controlled hive:
- Offline NTUSER.DAT edit: PoC opens an unloaded NTUSER.DAT and uses Offline Registry Library to redirect the `Local AppData` value to an attacker-controlled Object Manager path
- Object Manager symlink redirect: create a symlink in the Windows Object Manager namespace so a ProfSvc-trusted path points at the attacker path
- Batch oplock timing: use a batch opportunistic lock (oplock) to pause the service at the exact moment of profile load so the redirect is in place before Windows continues
Public PoC limitations
Researcher states the public PoC is a stripped version: it requires a second standard-user credential and only operates on `usrclass.dat`. The original has neither limit and can load arbitrary hives. Restoring the stripped PoC to the full version requires some thought—treated as a speed bump, not a safety lock.
Impact assessment
| Attribute | Detail | | --- | --- | | Affected systems | Windows 11, Windows Server 2019/2022, and all supported versions | | Vulnerability type | Local privilege escalation (LPE) | | Prerequisite | Standard user account on the target | | Result | Standard user to NT AUTHORITY SYSTEM | | CVE status | Unassigned | | Patch status | None | | In-the-wild | Unconfirmed; highly likely |
Remediation
Detection and mitigation (no patch)
- Limit local account sprawl: audit dormant/shared local accounts on terminal servers and shared systems; required by the public PoC
- Monitor ProfSvc anomalies:
- Watch ProfSvc (svchost.exe hosting profsvc) loading hive files outside expected profile paths - Flag non-SYSTEM processes creating junctions or symlinks in profile directories - Alert on registry hive mounts under HKCU classes root that do not match the currently logged-on user
- EDR behavior detection: detect:
- Standard-user processes accessing another user's UsrClass.dat or NTUSER.DAT - Symlink or directory object creation in profile paths during logon - Offline Registry Library use
Long-term
- Deploy July Windows updates first (this release does not fix LegacyHive; staying current remains baseline)
- Least privilege and strict account management on terminal servers
- Route endpoint telemetry to monitored locations
- Watch Microsoft security advisories and the CISA KEV catalog
References
- Secure.com: LegacyHive in-depth analysis
- Cyderes: LegacyHive technical analysis
- NetSecOps: LegacyHive PoC and IOC
- The CyberSignal: LegacyHive incident tracking