Security researcher Will Dormann disclosed a critical zero-day privilege escalation in Windows User Profile Service on July 16 2026. Dubbed "LegacyHive" the vulnerability allows unprivileged local users to hijack Administrator registry hives achieving SYSTEM-level code execution. No patch exists as of publication. CVE assignment pending.

Vulnerability Details

The flaw resides in the User Profile Service (ProfSvc) handling of registry hive loading during user logon. When a user logs in Windows loads their NTUSER.DAT registry hive into HKCU. LegacyHive exploits a race condition and improper validation allowing substitution of the Administrator hive with a malicious one.

Root Cause

1. Profile Service loads user hive without integrity verification
2. Race window exists between hive mount and access control enforcement
3. Unprivileged user can redirect HKCU to Administrator hive via symlink manipulation
4. Subsequent privileged operations write to attacker-controlled hive
5. Attacker achieves persistence and SYSTEM code execution

Technical Analysis

The vulnerability stems from legacy registry virtualization logic dating to Windows Vista. The Profile Service uses RegLoadKey with insufficient access checks. An attacker creates a directory junction pointing to the Administrator profile then triggers logon sequence causing the service to load the malicious hive as the target user's HKCU.

Rescana analysis confirms the exploit chain:

1. Create junction: C:\Users\attacker\AppData\Local\Microsoft\Windows\UsrClass.dat -> C:\Users\Administrator\NTUSER.DAT
2. Trigger logon via scheduled task or service interaction
3. Profile Service mounts attacker-controlled hive as Administrator HKCU
4. Attacker modifies Run keys services WMI event subscriptions for persistence
5. Achieves SYSTEM execution on next privileged operation

Impact Assessment

Severity

• CVSS v3.1: 9.8 Critical (AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H)
• Local attack vector but trivial complexity
• No user interaction required
• Scope changed (user to SYSTEM)
• Full compromise of confidentiality integrity availability

Affected Versions

All supported Windows versions including:

• Windows 10 21H2 22H2
• Windows 11 21H2 22H2 23H2 24H2
• Windows Server 2016 2019 2022 2025
• Windows Server 2025 (latest)

The vulnerability exists in the core Profile Service unchanged since Vista.

Exploitation Requirements

• Local authenticated access (standard user)
• Ability to create directory junctions (standard user right)
• No additional privileges required
• Reliable exploitation demonstrated by Rescana

Mitigation and Patching

No Official Patch Available

Microsoft has not released a fix. The disclosure follows responsible reporting with no response timeline confirmed. This is a "no-patch shutdown" advisory tier where the only immediate defense is detection and containment.

Detection Strategies

Event Log Monitoring

• Event ID 4657 (Registry value modified) with TargetObject in Administrator hive and SubjectUserName as non-admin
• Event ID 4688 (Process creation) with parent svchost.exe hosting profsvc.dll spawning unexpected children
• Event ID 4657 on HKLM\SYSTEM\CurrentControlSet\Services\ProfSvc configuration changes

Sysmon Configuration

YARA Rule for Malicious Hive Artifacts

Suricata Network Rule (Lateral Movement Post-Exploit)

Interim Containment

1. Restrict local logon rights via GPO: Deny log on locally for non-admin groups
2. Enable Windows Defender Application Control (WDAC) to block unsigned binaries
3. Monitor for junction creation via fsutil reparsepoint query in scripts
4. Audit RegLoadKey/RegUnLoadKey API calls via ETW
5. Isolate unpatched systems from critical network segments

Frequently Asked Questions

Is there a CVE number assigned?

CVE assignment is pending. Microsoft was notified per coordinated vulnerability disclosure. The researcher assigned the name "LegacyHive" for tracking.

Why hasn't Microsoft patched this?

The vulnerability exists in legacy Profile Service architecture. Fixing requires fundamental changes to hive loading validation which carries regression risk across all Windows versions. Microsoft may be developing a comprehensive fix rather than a targeted patch.

Can this be exploited remotely?

No. Initial access requires local authenticated session. However once an attacker has any foothold (phishing RDP compromise supply chain) LegacyHive provides reliable immediate SYSTEM escalation.

Does it affect Windows Server Core?

Yes. Server Core includes Profile Service for user logon scenarios.

Are there any mitigations in Windows 11 24H2?

No. The vulnerable code path exists in all versions. Enhanced security features (VBS HVCI WDAC) do not prevent the registry hive manipulation.

What is the exploitation reliability?

Rescana reports high reliability. The race window is consistent and junction creation is a standard user capability. No ASLR DEP or CFG bypass needed as the exploit operates at filesystem/registry level.

How does this compare to PrintNightmare or PetitPotam?

PrintNightmare (CVE-2021-34527) and PetitPotam (CVE-2021-36942) were remote attack vectors. LegacyHive is local privilege escalation but with higher reliability and no patch available making it more dangerous for post-exploitation.

Key Takeaways

• LegacyHive: Critical Windows LPE zero-day via User Profile Service registry hive manipulation
• CVSS 9.8 Critical local attack trivial complexity no user interaction
• All supported Windows versions affected (10 11 Server 2016-2025)
• No patch available Microsoft response timeline unknown
• Exploit chain: junction creation -> Profile Service race -> SYSTEM code execution
• Detection via registry monitoring Sysmon YARA Suricata
• Interim defenses: restrict local logon WDAC junction auditing network segmentation
• Post-exploitation: credential theft lateral movement persistence
• Represents "no-patch shutdown" advisory tier highest urgency for detection and containment

---

Sources:

• Rescana LegacyHive Windows Zero-Day Analysis
• Will Dormann Disclosure Twitter/X Thread
• Microsoft Security Response Center Case Tracking
• MITRE ATT&CK T1574.012 T1547.001 T1053.005