A prolific Windows zero-day hunter known as NightmareEclipse has published a new local privilege escalation exploit targeting the Windows User Profile Service. The vulnerability, dubbed LegacyHive, allows standard users to mount other users' registry hives—including administrators'—potentially enabling post-compromise privilege escalation. Microsoft has not yet issued a fix, and the researcher's partial proof-of-concept suggests capable attackers could weaponize it quickly.

Vulnerability Details

CVE ID: None assigned yet
CVSS Score: Not officially scored (estimated 7.0-7.8 Local Privilege Escalation)
Affected Component: profsvc (Windows User Profile Service)
Attack Vector: Local, requires valid user credentials
Impact: Arbitrary registry hive loading, cross-user hive access
Affected Versions: Windows 10/11 and Windows Server 2019/2022/2025 (fully patched as of July 2026 Patch Tuesday)

LegacyHive exploits a weakness in how profsvc loads user registry hives. The User Profile Service manages the loading and unloading of user registry hives (NTUSER.DAT and USRCLASS.DAT) during logon and logoff. The vulnerability allows a standard user to abuse the arbitrary hive loading mechanism to mount another user's hive—including an administrator's—into their own registry namespace under HKEY_CURRENT_USER\Software\Classes.

The public proof-of-concept code released on July 14, 2026, demonstrates mounting the usrclass.dat hive of a target user. However, NightmareEclipse has stated that the original, unreleased PoC does not require additional user credentials and works beyond the usrclass.dat hive—implying broader impact than the public code shows.

Impact Assessment

This is a post-exploitation primitive, not a remote code execution vulnerability. An attacker must already have valid credentials and local access to a Windows machine. However, once that foothold exists, LegacyHive provides a reliable path to escalate privileges by accessing sensitive registry keys in another user's hive.

Key risks include:

• Credential theft: Access to administrator registry hives may expose stored credentials, service account passwords, or application secrets
• Persistence mechanism modification: Attackers could alter Run keys, service configurations, or scheduled tasks in the target user's hive
• Defense evasion: Tampering with security product registry settings loaded from the user hive
• Lateral movement facilitation: Harvested credentials or modified configurations could enable movement to other systems

Matei Badanoiu, lead security researcher at Pentest-Tools.com, characterized the exploit as "a genuinely useful primitive for attackers who already have a foothold" but noted that "bundling it with credential access and persistence into 'full compromise' is more of an ambition than the released code."

Critically, NightmareEclipse's prior zero-days—BlueHammer and RedSun—transitioned from proof-of-concept to widespread exploitation within days. Huntress observed rapid adoption by threat actors and ransomware groups following those releases. Dray Agha, senior manager of security operations at Huntress, warned: "Given this history, we'd expect that capable actors will reverse-engineer the missing components of the LegacyHive PoC to build fully weaponized versions in short order."

Affected Systems

Any Windows system running the User Profile Service is potentially affected. This includes:

• Windows 10 (versions 21H2, 22H2)
• Windows 11 (versions 22H2, 23H2, 24H2)
• Windows Server 2019, 2022, and 2025
• Both domain-joined and standalone workgroup machines

The vulnerability exists in the default configuration. No special settings or roles are required for exploitation beyond standard user login capabilities.

Mitigation & Patching

No official patch is available as of July 16, 2026. Microsoft's July Patch Tuesday addressed 622 vulnerabilities but did not include a fix for LegacyHive. The researcher timed the disclosure to maximize the exposure window before the next monthly update cycle in August.

Microsoft was contacted for comment but had not responded at publication time. The company previously issued a quiet mitigation for NightmareEclipse's RoguePlanet zero-day (CVE-2026-50656) in early July without public documentation of the fix.

Interim Mitigations

Until a patch is released, organizations should consider:

1. Restrict local logons: Limit interactive logons to administrative accounts only. Use Group Policy (Computer Configuration > Windows Settings > Security Settings > Local Policies > User Rights Assignment > Deny log on locally) to prevent standard users from logging onto servers and critical workstations.

2. Monitor registry hive loading: Enable auditing for registry hive load/unload events (Event ID 4657 with specific registry paths, or ETW tracing for profsvc.dll activity). Look for RegLoadKey and RegLoadAppKey API calls originating from non-system processes.

3. Credential hygiene: Ensure service accounts and administrators don't share machines with standard users where possible. Enforce tiered administration models (PAWs/SAWs) to isolate privileged accounts.

4. Application control: Deploy Windows Defender Application Control (WDAC) or AppLocker to prevent execution of unsigned or untrusted binaries that might deliver the exploit payload.

5. Behavioral detection: Monitor for suspicious registry access patterns—particularly processes reading/writing to HKEY_CURRENT_USER\Software\Classes that correspond to other users' SIDs.

Detection

Organizations can hunt for LegacyHive exploitation attempts using the following indicators:

Registry Monitoring

ETW / Sysmon Event ID 12/13/14 (Registry)

Configure Sysmon with a rule targeting RegLoadKey and RegLoadAppKey operations:

Process Behavior

Watch for:

• Non-system processes calling RegLoadKey / RegLoadAppKey / NtLoadKey*
• profsvc.dll loading in unusual process contexts
• Standard user processes accessing registry keys under other users' SIDs

Threat Intelligence

• Track NightmareEclipse's GitHub/Gist releases and security mailing list posts
• Monitor for "LegacyHive" or "NightmareEclipse" in threat intelligence feeds
• Watch for weaponized variants in malware sandboxes (ANY.RUN, Hybrid Analysis, VirusTotal)

Frequently Asked Questions

Q: Is this exploitable remotely?
A: No. LegacyHive requires local access and valid user credentials. It is a local privilege escalation (LPE), not a remote code execution (RCE) vulnerability.

Q: Does the public PoC work against fully patched Windows?
A: Yes. NightmareEclipse claims the vulnerability exists in systems fully patched with July 2026 Patch Tuesday updates. The public PoC requires target user credentials and is limited to usrclass.dat, but the researcher asserts the full exploit works more broadly.

Q: Has this been assigned a CVE?
A: Not yet. NightmareEclipse did not coordinate disclosure through standard channels. A CVE assignment typically requires vendor acknowledgment or third-party coordination.

Q: Will Microsoft release an out-of-band patch?
A: Unclear. Microsoft has not publicly acknowledged LegacyHive. Given the active exploitation history of this researcher's prior zero-days, an out-of-band fix is possible but not guaranteed. The August 2026 Patch Tuesday is the next scheduled monthly release.

Q: How does this compare to RoguePlanet (CVE-2026-50656)?
A: RoguePlanet targeted Microsoft Defender's privileged service and allowed SYSTEM escalation. LegacyHive targets the User Profile Service and enables cross-user hive access. Both are post-exploitation LPEs from the same researcher. RoguePlanet received a quiet mitigation; LegacyHive has no known mitigation yet.

Q: Can standard AV/EDR detect this?
A: Signature-based detection is unlikely to catch the core exploit technique (registry hive loading is a legitimate OS function). Behavioral monitoring for anomalous registry access patterns and hive loading by non-system processes is more effective.

Key Takeaways

• LegacyHive is a fresh, unpatched Windows LPE zero-day disclosed July 14, 2026, by a researcher with a track record of rapid weaponization
• No CVE, no patch, no official acknowledgment from Microsoft as of July 16
• Post-exploitation primitive — requires local access and valid credentials, but enables cross-user registry hive access
• Public PoC is intentionally limited — the full exploit reportedly works without target credentials and beyond usrclass.dat
• Prior NightmareEclipse zero-days (BlueHammer, RedSun, RoguePlanet) saw rapid weaponization — defenders should act with urgency

---

Sources: The Register - LegacyHive zero-day disclosure, Huntress threat intelligence, Microsoft July 2026 Patch Tuesday release notes