Loading story…
Microsoft has patched CVE-2026-62832, a high-severity Windows User Profile Service elevation-of-privilege flaw publicly known as LegacyHive. The vulnerability stems from improper link resolution before file access (CWE-59) and affects supported versions of Windows 10, Windows 11, Windows Server 2022, and Windows Server 2025 prior to patched builds. Microsoft scored the bug 7.8 CVSS v3.1, and the issue allows an authorized local attacker to escalate privileges on vulnerable systems.
Public reporting said the flaw could let an authenticated attacker with credentials for another local account load that user's registry hive, alter data, and potentially obtain administrator privileges without user interaction. The zero-day was publicly disclosed by the researcher known as Nightmare Eclipse, who released a proof-of-concept exploit after the July Patch Tuesday updates; researchers including Will Dormann and Kevin Beaumont analyzed the exploit, while ACROS Security had already issued unofficial 0Patch micropatches before Microsoft's official advisory and fix were released.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
7 events from the most recent confirmed update back to the earliest known activity.
The CVE record for CVE-2026-62832 was published, describing a Windows User Profile Service elevation-of-privilege flaw caused by improper link resolution before file access. The record says an authorized local attacker can elevate privileges and assigns a CVSS 7.8 High severity rating.
Microsoft released an official fix for LegacyHive in its August 2026 Patch Tuesday updates, tracking the issue as CVE-2026-62832. The patch addressed the Windows User Profile Service zero-day that could let a local authenticated attacker gain administrator privileges without user interaction.
ACROS Security released free unofficial micropatches for LegacyHive through its 0Patch platform, covering Windows 10 version 2004 or later and Windows Server 2022 or later. This provided a third-party mitigation before Microsoft's official fix.
One day after the proof-of-concept was released, Kevin Beaumont published Microsoft Defender for Endpoint detection queries for LegacyHive and confirmed the exploit worked. This added independent validation and defensive guidance for the vulnerability.
Hours after the July 2026 Patch Tuesday updates were released, Nightmare Eclipse published a proof-of-concept exploit for LegacyHive. Researchers later said the exploit could let a non-admin modify another user's registry hive and potentially gain code execution when an administrator logs in.
A researcher using the handle Nightmare Eclipse publicly disclosed the Windows User Profile Service vulnerability later tracked as CVE-2026-62832. Microsoft said it was aware of the report and was investigating the validity and applicability of the claims.
The CVE entry for CVE-2026-62832 was updated after publication. The record continued to reference Microsoft's advisory and affected Windows 10, Windows 11, Windows Server 2022, and Windows Server 2025 builds prior to patched versions.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
bleepingcomputer.com
Open sourcecve.org
Open sourcemsrc.microsoft.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Security researcher **NightmareEclipse/Chaotic Eclipse** publicly released a proof-of-concept exploit for a Windows local elevation-of-privilege zero-day dubbed **LegacyHive**, targeting the **Windows User Profile Service** (`ProfSvc`). The flaw abuses arbitrary registry hive loading to let a standard user mount another user’s registry hive—particularly `usrclass.dat`—under their own registry classes root, potentially exposing sensitive registry data and enabling privileged read-write access that could support further escalation. Reports said the public PoC was intentionally limited and may require additional user credentials, while the researcher claimed the original technique could load arbitrary hives without that restriction. The disclosure said the issue affects fully patched supported Windows desktop and server versions, including systems updated through **July 2026**, and no **CVE**, Microsoft advisory, or official patch had been identified at the time of publication. Researchers and defenders warned that, although the released PoC does not by itself guarantee full system compromise, it provides a strong **post-compromise primitive** that skilled attackers could weaponize quickly, especially given prior rapid criminal adoption of the researcher’s earlier Microsoft disclosures. Background documentation on Windows registry hives shows that user profile hives store application settings, desktop configuration, environment data, network connections, and other per-user information, underscoring the sensitivity of unauthorized hive access.
Jul 28, 2026
Researchers detailed **LegacyHive**, a Windows proof-of-concept that abuses user profile initialization and offline registry hive manipulation to achieve post-compromise impact on fully patched systems, including hosts updated after Microsoft’s July 2026 Patch Tuesday. Rather than exploiting a traditional software flaw, the technique modifies a target profile’s `ntuser.dat` or `UsrClass.dat`, redirects a helper account’s `Local AppData` path into an attacker-controlled NT Object Manager namespace, and then triggers profile loading with `CreateProcessWithLogonW` so Windows consumes the tampered hive. LevelBlue said it reproduced the full chain on patched Windows systems and assessed the method as more relevant for **post-compromise abuse** than standalone initial access because the released PoC requires a low-privileged account and helper-account credentials. The reporting highlights several hunting opportunities, including rare NT native API usage, offline changes to user registry hives, Object Manager path artifacts in the **Volatile Environment** key, batch opportunistic locks, and unusual cross-account profile loading behavior tied to named object directories and symbolic-link style redirection.
Jul 28, 2026
Microsoft released fixes for 61 vulnerabilities in its May security updates, including three zero-days and one critical flaw, with **CVE-2024-30040** and **CVE-2024-30051** confirmed as actively exploited in the wild. The patched issues affect core Microsoft products including Windows, Office, SharePoint, .NET, Visual Studio, and Windows Server, and include a **Windows MSHTML Platform security feature bypass** and a **Windows DWM Core Library elevation-of-privilege flaw** that can allow attackers to gain `SYSTEM` privileges. Researchers who reported **CVE-2024-30051** said they validated the Windows Desktop Window Manager flaw after finding a suspicious document uploaded to VirusTotal, then later observed an exploit in mid-April being used with **QakBot** and other malware. Kaspersky assessed that multiple threat actors likely had access to the exploit before the patch was released, underscoring the urgency for organizations to deploy Microsoft's updates immediately across affected Windows and server environments.
Jul 24, 2026