A security researcher known as Nightmare Eclipse released a proof-of-concept exploit named LegacyHive that abuses a vulnerability in the Windows User Profile Service. This zero-day allows attackers who already have some user credentials to escalate privileges by mounting the target user's registry hive under the current user's classes root. The exploit requires three sets of credentials, including a third username which can be an administrator account, limiting its ease of exploitation. If successful, attackers can modify the classes registry hive to achieve automatic code execution upon admin login, such as associating file types with arbitrary executables. Microsoft has acknowledged the issue and is investigating but has not yet assigned a CVE or provided a patch. Detection queries for Microsoft Defender for Endpoint have been published to help identify exploitation attempts.

The vulnerability allows non-admin users with some credentials to escalate privileges to administrator level by modifying the registry hive. This can lead to automatic code execution with admin privileges when the administrator logs in, potentially enabling full system compromise. However, the exploit requires additional credentials, reducing the likelihood of widespread exploitation. There are no known exploits in the wild at this time.

Microsoft is actively investigating the vulnerability and has not yet released a patch. Detection queries for Microsoft Defender for Endpoint are available to help identify potential exploitation attempts. Organizations should apply the latest Microsoft Patch Tuesday updates and monitor for related alerts. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.