Even fully updated Windows does not always protect against already known techniques: published exploit LegacyHive allows the average user to prepare the code with administrator rights the next time the privileged account is entered.
The author under the pseudonym Nightmare Eclipse revealed the vulnerability of zero day shortly after the release of the July updates of Microsoft. The error affects the Windows user profile service and has not yet received the CVE identifier. The verification code works on current versions of the system.
LegacyHive allows you to connect the registry section of another user to the current account and change the settings associated with the start of programs. Analyst Will Dorman confirmed the operation of the exploit and showed a test scenario in which the opening of the text file ran a calculator. A more dangerous modification could perform an arbitrary code after logging in to the administrator.
The published version is deliberately limited. To run, you need the data of another regular account and the third user name that can be the administrator. According to the author, the original version did not require additional accounting data and allowed to download other sections of the registry, but these opportunities were removed to make it difficult to use.
Kevin Beaumont also checked LegacyHive and prepared requests to detect traces of operation through Microsoft Defender for Endpoint. There is no information about the use of the vulnerability in real attacks yet.
Microsoft has confirmed that it is studying the message and checking which products affected. The company has not yet released an update and has not named the deadline for eliminating the error. Prior to the fixation, organizations may use published Microsoft Defender for Endpoint queries to search for suspicious activity related to LegacyHive.
Earlier, Nightmare Eclipse published information and verification code for a number of zero-day vulnerabilities, including GreatXML, RedSun, MiniPlastma, YellowKey, BlueHammer, UnDefend, GreenPlasma and Rogue Planet. Microsoft shut down GreenPlasma, MiniPlasma and YellowKey in the June 2026 updates, and RoguePlanet eliminated in July.
The author under the pseudonym Nightmare Eclipse revealed the vulnerability of zero day shortly after the release of the July updates of Microsoft. The error affects the Windows user profile service and has not yet received the CVE identifier. The verification code works on current versions of the system.
LegacyHive allows you to connect the registry section of another user to the current account and change the settings associated with the start of programs. Analyst Will Dorman confirmed the operation of the exploit and showed a test scenario in which the opening of the text file ran a calculator. A more dangerous modification could perform an arbitrary code after logging in to the administrator.
The published version is deliberately limited. To run, you need the data of another regular account and the third user name that can be the administrator. According to the author, the original version did not require additional accounting data and allowed to download other sections of the registry, but these opportunities were removed to make it difficult to use.
Kevin Beaumont also checked LegacyHive and prepared requests to detect traces of operation through Microsoft Defender for Endpoint. There is no information about the use of the vulnerability in real attacks yet.
Microsoft has confirmed that it is studying the message and checking which products affected. The company has not yet released an update and has not named the deadline for eliminating the error. Prior to the fixation, organizations may use published Microsoft Defender for Endpoint queries to search for suspicious activity related to LegacyHive.
Earlier, Nightmare Eclipse published information and verification code for a number of zero-day vulnerabilities, including GreatXML, RedSun, MiniPlastma, YellowKey, BlueHammer, UnDefend, GreenPlasma and Rogue Planet. Microsoft shut down GreenPlasma, MiniPlasma and YellowKey in the June 2026 updates, and RoguePlanet eliminated in July.
