7 minhigh
LegacyHive: Nightmare-Eclipse’s Latest Zero-Day Drop with a Stripped PoC
Security researcher Nightmare-Eclipse publicly disclosed LegacyHive, an unpatched Local Privilege Escalation vulnerability in the Windows User Profile component. The flaw allows attackers to load other users' registry hives without requiring user credentials, potentially exposing application data and Windows Explorer history. The vulnerability affects all Windows desktop and server versions, including those updated with July 2026 Patch Tuesday, and remains unacknowledged and unpatched by Microsoft.
Sens:▲ 24hConf:medium
Detection / Hunteropenrouter
What Happened
A security researcher has publicly revealed a new unpatched flaw in Windows called LegacyHive. This flaw lets someone who already has access to a computer load other users' profile data (think of profiles as personal settings and history stored by Windows) without needing their passwords. This means an attacker could read another user's application data or their Windows Explorer browsing history. The problem affects all versions of Windows, including those that received the latest security updates in July 2026. Microsoft has not yet released a fix. Organizations should monitor for unusual activity around user profile data and apply a patch as soon as Microsoft releases one.
Key Takeaways
- LegacyHive is an unpatched Windows Local Privilege Escalation vulnerability in the Windows User Profile component that allows loading other users' registry hives without credentials
- The vulnerability works on all Windows desktop and server versions, including systems patched with the July 2026 Patch Tuesday updates
- The original PoC could load any hive including administrator hives, but the publicly released PoC was intentionally stripped to deter exploitation
- Microsoft has not yet publicly acknowledged or released a patch for LegacyHive as of the article's publication
- The same researcher previously released RoguePlanet (SYSTEM-level race condition exploit) and GreatXML (BitLocker bypass) in June 2026
Affected Systems
- All Windows desktop versions (including July 2026 Patch Tuesday patched systems)
- All Windows server versions (including July 2026 Patch Tuesday patched systems)
Vulnerabilities (CVEs)
None identified.
Attack Chain
- Precondition: Attacker has some level of local access to a Windows system
- Exploitation: Attacker triggers the LegacyHive LPE vulnerability in the Windows User Profile component
- Hive Loading: Vulnerability allows loading of other users' registry hives without requiring user credentials
- Data Access: Attacker reads application data and Windows Explorer history from the loaded hives
- Exfiltration: Accessed data could be exfiltrated for further exploitation or intelligence gathering
Detection Availability
- YARA Rules: No
- Sigma Rules: No
- Snort/Suricata Rules: No
- KQL Queries: No
- Splunk SPL Queries: No
- EQL Queries: No
- Other Detection Logic: No
No detection rules or queries are provided in the article. The PoC was intentionally stripped by the researcher, limiting immediate detection development from public artifacts.
Detection Engineering Assessment
copy:
| Dimension | Rating | Rationale |
|---|---|---|
| EDR Visibility | Medium | Registry hive loading and unloading operations may be captured by EDR telemetry, but distinguishing legitimate hive operations from malicious ones requires behavioral analysis. The Windows User Profile component's normal operations may generate significant baseline noise. |
| Network Visibility | None | LegacyHive is a local privilege escalation vulnerability with no network component. All exploitation occurs locally on the endpoint. |
| Detection Difficulty | Hard | The Windows User Profile component routinely loads and unloads user hives as part of normal operation. Distinguishing legitimate hive loading from malicious loading via this vulnerability requires understanding process context, caller identity, and target hive ownership. Without a full PoC, developing reliable detections is challenging. |
Required Log Sources
- Windows Security Event Log (Event ID 4656, 4663 for registry access)
- Sysmon Event ID 12 (RegistryEvent object create/delete) and Event ID 13 (RegistryEvent value set)
- Sysmon Event ID 10 (ProcessAccess) for monitoring hive loading processes
- EDR process and registry telemetry
Hunting Hypotheses
copy:
| Hypothesis | Telemetry | ATT&CK Stage | FP Risk |
|---|---|---|---|
| Consider hunting for processes that load registry hives belonging to other user accounts, which may indicate exploitation of the LegacyHive vulnerability. Focus on cases where a non-admin user process loads an administrator's hive. | Sysmon Event ID 12/13 for registry key operations, EDR registry telemetry, Windows Security Event Log for registry access events | Privilege Escalation / Collection | High — legitimate administrative tools, user profile migration utilities, and forensic tools may load other users' hives as part of normal operations. |
| Consider hunting for unusual calls to the Windows User Profile API (profile loading/unloading functions) originating from non-system processes, which could indicate an attempt to exploit the LegacyHive vulnerability. | EDR API call telemetry, Sysmon process access events, Windows Event Log for profile service events | Privilege Escalation | Medium — some legitimate applications may interact with the User Profile service, but non-system processes doing so are less common. |
| Consider hunting for processes accessing NTUSER.DAT files belonging to other user accounts, particularly when the accessing process is not running under that user's context or a system service account. | Sysmon Event ID 11 (FileCreate) for NTUSER.DAT access, EDR file access telemetry, Windows Security Event Log for file access events | Collection | Medium — backup software, forensic tools, and profile management utilities may legitimately access other users' NTUSER.DAT files. |
Control Gaps
- Standard antivirus signatures will not detect this vulnerability exploitation as it leverages legitimate Windows components
- Application whitelisting may not prevent exploitation since the attack uses built-in Windows functionality
- Network-based detection tools have no visibility into this local privilege escalation attack
- Without behavioral registry monitoring, the attack may go completely undetected
Key Behavioral Indicators
- Non-system process invoking Windows User Profile service APIs to load hives
- Process accessing registry hive files (NTUSER.DAT) for user accounts other than the one it runs under
- Registry hive load operations performed without corresponding user logon events
- Access to Windows Explorer history data from hives not belonging to the current user context
False Positive Assessment
High — The Windows User Profile component routinely loads and unloads user hives during normal logon/logoff operations. Legitimate administrative, forensic, and profile management tools also load registry hives, making behavioral detection challenging without strong process context and baseline understanding.
Recommendations
Immediate Mitigation
defender takeaway
- Verify against your organization's incident response runbook and team escalation paths before acting. Consider monitoring for unusual registry hive loading activity, particularly processes accessing NTUSER.DAT files belonging to other user accounts.
- Consider evaluating whether any local users have unnecessary privileges that could be leveraged as a precondition for this LPE vulnerability.
- If your EDR supports registry access monitoring, consider enabling or tuning alerts for non-system processes interacting with the Windows User Profile service or loading external registry hives.
Infrastructure Hardening
- Consider applying the principle of least privilege to limit the number of accounts that could serve as a launching point for this local privilege escalation.
- Evaluate whether Sysmon or equivalent registry monitoring is deployed across Windows endpoints to capture hive loading events for future hunting.
- Consider implementing application control policies that restrict which processes can interact with the Windows User Profile service APIs.
User Protection
- Consider restricting interactive local access on shared or multi-user Windows systems where this vulnerability poses the greatest risk of cross-user data exposure.
- If applicable, evaluate whether sensitive user profile data (application credentials, browsing history stored in registry hives) should be protected with additional access controls.
Security Awareness
- Consider informing IT and security teams about this unpatched vulnerability so they can watch for indicators of exploitation in environments with shared Windows endpoints.
- Consider rolling a reminder into existing awareness programs that users should avoid sharing local accounts or leaving sessions unlocked on multi-user Windows systems.
MITRE ATT&CK Mapping
MITRE ATT&CK Mapping3 techniques
Tactic
Privilege Escalation
Tactic
Credential Access
Tactic