Nightmare Eclipse released a zero-day local privilege escalation vulnerability named LegacyHive affecting the Windows User Profile Service. The vulnerability enables an attacker with standard user credentials and a third username (potentially an administrator) to mount another user's registry hive, including administrator hives, under the current user's context. The researcher provided a stripped proof-of-concept exploit that works on systems with July 2026 Microsoft patches applied. The original exploit reportedly did not require credentials and could load any hive, but the released PoC requires credentials and targets the usrclass.dat hive. Microsoft has not issued any advisory or patch for this vulnerability as of the publication date.

Successful exploitation of LegacyHive allows a local attacker with standard user credentials to escalate privileges by loading and accessing other users' registry hives, including those of administrators. This could lead to unauthorized access to sensitive system and user configuration data and potentially full system compromise. The vulnerability affects fully patched Windows systems as of July 2026 Patch Tuesday, indicating that existing patches do not mitigate this issue. There are no reports of active exploitation in the wild at this time.

As of the current information, Microsoft has not acknowledged or released a patch for the LegacyHive vulnerability. The proof-of-concept exploit was released in a stripped form to limit immediate exploitation. Organizations should monitor official Microsoft advisories for updates and patches addressing this vulnerability. Until a patch is available, restricting local user access and applying the principle of least privilege may reduce risk. No specific vendor mitigation or workaround has been published.