LegacyHive is a local privilege escalation vulnerability in the Windows User Profile Service caused by improper link resolution before file access ('link following'). An authenticated attacker with credentials for a local account can run a specially crafted application to load another user's registry hive, resulting in automatic code execution with administrator privileges when the targeted admin logs in. The vulnerability was disclosed after the July 2026 Patch Tuesday, with proof-of-concept exploit code released by the researcher 'Nightmare Eclipse'. Microsoft released official patches in the August 2026 Patch Tuesday updates and tracks the vulnerability as CVE-2026-62832. The exploit requires valid credentials, making it harder to weaponize compared to other zero-days. ACROS Security released unofficial patches for Windows 10 2004+ and Windows Server 2022+ prior to Microsoft's official update.

Successful exploitation allows a local attacker with credentials for a non-administrator account to gain administrator privileges by loading another user's registry hive and executing code automatically upon admin login. This elevates the attacker's privileges on the system without requiring user interaction. The vulnerability affects the Windows User Profile Service and could lead to unauthorized access or modification of another user's data and system control.

Microsoft has released official patches for this vulnerability as part of the August 2026 Patch Tuesday updates. Systems should be updated promptly to apply these fixes. Prior to the official patch, ACROS Security provided unofficial patches for Windows 10 version 2004 and later, and Windows Server 2022 and later. No additional mitigation steps are indicated by Microsoft beyond applying the official update.