"Microsoft is aware of the reported vulnerability and is actively investigating the validity and potential applicability of these claims," a Microsoft spokesperson told BleepingComputer. "Microsoft is committed to investigating security issues and updating impacted products to protect customers as soon as possible."
What LegacyHive is and how it was disclosed
The flaw, dubbed LegacyHive, was disclosed by a researcher using the handle Nightmare Eclipse in the Windows User Profile Service on the same day Microsoft released its July 2026 Patch Tuesday updates. The disclosure included a stripped proof-of-concept (PoC) exploit intended to make it harder for threat actors to weaponize the issue. Microsoft has not yet assigned a CVE identifier nor released a security update addressing LegacyHive.
How the exploit operates, according to analysts
Tharros principal vulnerability analyst Will Dormann examined the PoC and reported that non-admin users can exploit LegacyHive to modify the classes registry hive and gain automatic code execution when the admin account logs into a compromised device. ACROS Security CEO Mitja Kolsek summarized the impact similarly: "The vulnerability allows a regular non-admin user to mount any other user's registry hive in full access mode, and then either extract that user's stored secrets or modify any values in their registry to affect what gets executed the next time they log in."
Security commentator Kevin Beaumont also confirmed that the exploit works one day after the PoC was released and published LegacyHive exploitation detection queries for Microsoft Defender for Endpoint, giving defenders concrete search and detection artifacts to use while vendor patches are still pending.
Unofficial fixes: ACROS Security's 0patch micropatches
With no official Microsoft patch yet available, ACROS Security — the company behind the 0patch platform — released free micropatches that target the vulnerable code path. ACROS describes micropatches as small code injections that replace the vulnerable section of code. The company offers these micropatches for systems running Windows 10 2004 or later and Windows Server 2022 or later; ACROS notes the flaw does not affect systems running versions older than Windows 10 2004 and Windows Server 2019.
Installation requires registering a 0patch account and installing the 0patch agent. If no custom patching policies block it, the micropatch will be deployed automatically and, according to ACROS, does not require a system restart after the agent is launched. Kolsek said the micropatch changes the exploit's target behavior: "With 0patch enabled, the exploit still seems to work, but it loads a temporary user profile hive instead of that from adminuser. Loading a temporary user profile hive is of no use to the attacker."
Where LegacyHive fits in Nightmare Eclipse's recent disclosures
Nightmare Eclipse has disclosed multiple zero-day exploits affecting Microsoft products and Windows components in recent months, including RoguePlanet, BlueHammer, RedSun, YellowKey, GreenPlasma, MiniPlasma, and UnDefend. Microsoft fixed YellowKey, GreenPlasma, and MiniPlasma in the June 2026 Patch Tuesday updates and addressed RoguePlanet in the July security updates; other issues disclosed by Nightmare Eclipse remain without vendor patches.
How defenders, enterprises, and adversaries can — and are likely to — respond
- Technologists and security teams: defenders have immediate actions available — ACROS's 0patch micropatches can be installed by registering a 0patch account and deploying the 0patch agent, and Kevin Beaumont's published Microsoft Defender for Endpoint queries give detection logic that teams can implement while awaiting an official Microsoft update.
- Enterprises and system administrators: organizations running affected versions (Windows 10 2004+ and Windows Server 2022+) will face a choice between waiting for an official Microsoft patch or deploying the free 0patch micropatch; ACROS notes the micropatch can deploy without a restart if policies allow.
- Adversaries and threat actors: the PoC was published in stripped form to deter rapid weaponization, but independent confirmation that the exploit works indicates adversaries could attempt their own implementations; ACROS's micropatch reportedly neuters the attack by forcing a temporary profile hive to be loaded instead of the targeted admin hive.
Microsoft's public statement commits the company to investigation and to updating impacted products "as soon as possible," while third-party mitigations are already available for many modern Windows installs. The record for LegacyHive is, for now, a clear demonstration of two realities: a disclosed elevation-of-privilege vector that analysts say can lead to automatic code execution when an administrator logs in, and an active ecosystem of rapid, unofficial mitigation options alongside vendor investigation.
