Loading vulnerability…
LegacyHive
CVE-2026-62832, known as LegacyHive, is a high-severity local elevation-of-privilege vulnerability in the Windows User Profile Service. Improper link resolution before file access allows an authorized attacker to cause the service to load another local user’s registry hive. An attacker possessing credentials for a second local account can run a specially crafted application to access or modify that user’s data, including registry data associated with an administrative account, and potentially obtain administrator privileges. The issue was publicly disclosed before Microsoft released its August 2026 security updates.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation permits local privilege escalation from a low-privileged authenticated context to administrator privileges. The attacker may access or modify data in another local user’s registry hive, compromising confidentiality and integrity and potentially obtaining full administrative control of the affected system. No interaction by the targeted user is required.
If you can’t patch tonight, do this now.
Until updates are deployed, reduce opportunities for local code execution by enforcing least privilege, restricting interactive access to affected systems, and limiting use of shared local accounts. Protect and rotate credentials for local accounts, especially accounts with administrative privileges; avoid providing users with credentials for other local accounts. Monitor for anomalous User Profile Service activity, unexpected registry-hive loading, and unauthorized modifications to user profile or classes-related registry data. Unofficial micropatches were reported for some affected versions before the vendor update, but the Microsoft security update is the preferred remediation.
Patch, then assume compromise.
Install Microsoft’s August 2026 or later security updates for all affected Windows systems. Update affected builds to at least Windows 10 21H2 build 19044.7663; Windows 10 22H2 build 19045.7663; Windows 11 23H2 build 22631.7517; Windows 11 24H2 and 25H2 build 26100.9168 and 26200.9168 respectively; Windows 11 26H1 build 28000.2704; Windows Server 2022 build 20348.5499; and Windows Server 2025 build 26100.33296. Validate update deployment across both client and server fleets.
1 exploit validated by Mallory's analysis.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
53 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.