Full Report
Microsoft has released security patches to address a Windows zero-day vulnerability known as "LegacyHive," disclosed after the July 2026 Patch Tuesday. [...]
Analysis Summary
# Vulnerability: LegacyHive Privilege Escalation in Windows User Profile Service
## CVE Details
- **CVE ID:** CVE-2026-62832
- **CVSS Score:** Not explicitly listed in the article (typically High for Local Privilege Escalation)
- **CWE:** CWE-59: Improper Link Resolution Before File Access ('Link Following')
## Affected Systems
- **Products:** Microsoft Windows, Windows Server
- **Versions:** Windows 10 (version 2004 and later), Windows Server 2022 (and later).
- **Configurations:** Systems where multiple local user accounts exist; the attacker requires credentials for a secondary local account.
## Vulnerability Description
The "LegacyHive" vulnerability exists within the **Windows User Profile Service**. The flaw stems from improper link resolution (link following) before the service accesses files. An authenticated attacker can exploit this logic flaw by running a specially crafted application to load another user's registry hive. Specifically, a non-admin user can modify the classes registry hive to trigger automatic code execution when an administrator subsequently logs into the compromised system.
## Exploitation
- **Status:** Exploited in the wild; Proof of Concept (PoC) available (published by "Nightmare Eclipse").
- **Complexity:** Medium (Requires credentials for another local account, making it harder to weaponize than "no-auth" exploits).
- **Attack Vector:** Local
## Impact
- **Confidentiality:** High (Access to other users' data and registry hives).
- **Integrity:** High (Modification of registry hives and system data).
- **Availability:** High (Full administrative control over the system).
## Remediation
### Patches
- **Official:** Microsoft released official patches as part of the **August 2026 Patch Tuesday** updates.
- **Unofficial:** ACROS Security released "0patch" micro-fixes on July 20, 2026, for Windows 10 (2004+) and Server 2022.
### Workarounds
- No specific configuration workarounds were provided; immediate patching of the Windows User Profile Service is recommended.
- Restrict local logon privileges to essential personnel to reduce the attack surface.
## Detection
- **Indicators of Compromise:** Unusual modifications to registry hives (specifically `HKEY_CLASSES_ROOT` or user-specific classes hives) initiated by non-admin users.
- **Detection Methods:**
- Use Microsoft Defender for Endpoint (MDE) to monitor for suspicious User Profile Service activity.
- Advanced Hunting: Kevin Beaumont has published KQL (Kusto Query Language) queries for hunting LegacyHive exploitation.
- Reference Query: hxxps[://]github[.]com/GossiTheDog/ThreatHunting/blob/master/AdvancedHuntingQueries/LegacyHive[.]kql
## References
- **Vendor Advisory:** hxxps[://]msrc[.]microsoft[.]com/update-guide/en-US/advisory/CVE-2026-62832
- **PoC Repository:** hxxp[://]github[.]com/MSNightmare/LegacyHive
- **Researcher Socials:** hxxps[://]infosec[.]exchange/@wdormann/116924062172195933
- **Analysis:** hxxps[://]cyberplace[.]social/@GossiTheDog/116924829769626646