Loading vulnerability…
CVE-2026-62832, known as LegacyHive, is a high-severity local elevation-of-privilege vulnerability in the Windows User Profile Service. Improper link resolution before file access allows an authorized attacker to cause the service to load another local user’s registry hive. An attacker possessing credentials for a second local account can run a specially crafted application to access or modify that user’s data, including registry data associated with an administrative account, and potentially obtain administrator privileges. The issue was publicly disclosed before Microsoft released its August 2026 security updates.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos.
This three-file repository contains a standalone Windows C++ proof of concept, LegacyHive.cpp, an MIT license, and a short README. It is not associated with a recognized exploitation framework. The PoC targets a local Windows User Profile Service flaw described as an arbitrary user-hive load elevation-of-privilege issue; no CVE identifier is provided. The executable accepts a username, password, and target-user-hive argument. It starts C:\Windows\notepad.exe suspended with CreateProcessWithLogonW and LOGON_WITH_PROFILE under supplied secondary-user credentials, then uses Windows native APIs resolved from ntdll (NtCreateSymbolicLinkObject and NtCreateDirectoryObjectEx), profile/token APIs, offline-registry APIs, and file operations to arrange the hive-loading condition. It generates a GUID, creates a working directory with an Everyone:GENERIC_ALL DACL, and creates native object-manager directory/symlink structures under the globalroot/BaseNamedObjects namespace. The visible cleanup logic terminates the helper process/thread, restores modified hive content when needed, removes temporary hive files and the working directory, and reverts impersonation. The README states that the intentionally restricted PoC is limited to loading usrclass.dat and, on success, mounts the target user hive under the invoking user's Classes root. It further claims the original internal PoC could load arbitrary hives without the extra credentials, but that capability is not represented as available in this public code. There is no command shell, downloader, network C2, or remote payload. Its capability is a local registry/profile-hive access and mounting primitive that can facilitate privilege escalation when the chosen target is privileged.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
53 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A zero-day elevation of privilege vulnerability in the Windows User Profile Service that Microsoft says attackers could exploit and that was publicly disclosed before a patch was available.
A high-severity local privilege escalation vulnerability in the Windows User Profile Service that allows a low-privileged authenticated attacker to load another user's registry hive and gain administrator privileges.
A Windows User Profile Service local privilege escalation vulnerability caused by improper link resolution before file access ('link following'), allowing an authenticated local attacker with credentials for another local account to load another user's registry hive, access or modify another user's data, and gain administrator privileges.
Privilege escalation vulnerability mentioned only as part of Microsoft's August patch set and the broader dispute with the researcher.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.