CVE-2026-62832 — a Windows zero-day tracked as "LegacyHive" — has been patched by Microsoft in the August Patch Tuesday updates after a public proof-of-concept was released following July's updates.
Microsoft's August patch: CVE-2026-62832
Microsoft included a fix for LegacyHive in its August Patch Tuesday release and is tracking the issue as CVE-2026-62832. The company describes the root cause as "improper link resolution before file access ('link following')" in the Windows User Profile Service, and warns that "successful exploitation allows local attackers to gain administrator privileges."
Microsoft also provided a technical summary of the exploitation scenario: "An authenticated attacker who has credentials for another local account could run a specially crafted application to load another user's registry hive," the company said. "Successful exploitation could allow the attacker to access or modify another user's data and gain administrator privileges. User interaction is not required."
Nightmare Eclipse's disclosure and the public PoC
The vulnerability disclosure that precipitated the patch came after a security researcher using the handle "Nightmare Eclipse" published a proof-of-concept (PoC) exploit hours after the July 2026 Patch Tuesday updates. The researcher has framed their disclosures as a protest of Microsoft's bug bounty and vulnerability disclosure practices.
Unlike some prior releases from the same handle, the LegacyHive PoC requires additional credentials, a constraint the source material notes makes it "harder for threat actors to weaponize the vulnerability." Microsoft has not publicly acknowledged Nightmare Eclipse as the reporter; the company instead tagged the report as coming from an anonymous researcher. Earlier, when asked about LegacyHive, "Microsoft is aware of the reported vulnerability and is actively investigating the validity and potential applicability of these claims," a Microsoft spokesperson told BleepingComputer.
Your scanner finds 4,000 vulns. Which 12 matter?
Nubivance is a Rapid7 Registered Partner delivering vulnerability management as a service - scanning, risk-based prioritization, and remediation follow-through across IT and OT.
Fix the backlogHow LegacyHive works: User Profile Service and the classes registry hive
Vulnerability analyst Will Dormann explained the operational mechanics observed in the PoC: non-administrative users can use the exploit to modify the classes registry hive and achieve automatic code execution when an administrative account later logs into the compromised system. That pathway—manipulating a registry hive to obtain code execution at admin login—underscores why the vulnerability permits privilege escalation without interactive user consent.
Security researcher Kevin Beaumont corroborated the exploit's effectiveness the day after the PoC appeared, publishing Microsoft Defender for Endpoint (MDE) detection queries and confirming that the LegacyHive exploit worked against targeted systems.
Unofficial fixes from ACROS Security and the disclosure history
Before Microsoft's August patch, ACROS Security—the company behind the 0Patch platform—released free unofficial LegacyHive mitigations on July 20 for systems running Windows 10 2004 or later and Windows Server 2022 or later. Those mitigations were provided while the vulnerability awaited an official Microsoft update.
Nightmare Eclipse has disclosed multiple zero-day flaws since April 2026, including ShieldBreak, LegacyHive, RoguePlanet, YellowKey, BlueHammer, RedSun, GreenPlasma, MiniPlasma, and UnDefend, affecting Microsoft Defender, BitLocker, and other Windows components. Microsoft addressed YellowKey, GreenPlasma, and MiniPlasma as part of June's Patch Tuesday and patched RoguePlanet in July; the remaining disclosed zero-days were still awaiting official patches at the time of the report.
What this means for technologists, enterprises, and adversaries
- Technologists and security teams: Teams with Microsoft Defender for Endpoint can deploy the detection queries Kevin Beaumont published to hunt for LegacyHive exploitation, and should prioritize applying Microsoft's August patches or ACROS mitigations where appropriate.
- Affected enterprises and procurement leaders: Organizations running Windows 10 2004 or later and Windows Server 2022 or later should note ACROS's July 20 mitigations as an interim option and schedule the official CVE-2026-62832 update from Microsoft as part of their patch cycles.
- Adversaries and threat actors: The released PoC requires additional credentials, which the report says limits immediate weaponization, but the vulnerability's capability to grant administrator privileges through registry hive modification remains a potent escalation path if credentials are obtained.
Microsoft has now closed the immediate LegacyHive vulnerability with its August patch, but the broader disclosure campaign by the researcher known as Nightmare Eclipse — and the list of other reported zero-days still awaiting official fixes — leaves a set of named vulnerabilities and interim mitigations that defenders must track closely.
