Microsoft has issued security patches to address a Windows zero-day vulnerability, identified as "LegacyHive," which was publicly disclosed following the July 2026 Patch Tuesday. The vulnerability, now tracked as CVE-2026-62832, was patched as part of Microsoft's August Patch Tuesday updates.
The flaw was initially disclosed by a security researcher operating under the pseudonym "Nightmare Eclipse," who released a proof-of-concept (PoC) exploit hours after the July 2026 Patch Tuesday updates. Nightmare Eclipse stated that the exploit targets a vulnerability within the Windows User Profile Service. However, unlike some of their previous disclosures, this PoC requires additional credentials, potentially increasing the difficulty for threat actors to weaponize it.
Microsoft has confirmed that LegacyHive is a privilege escalation vulnerability stemming from improper link resolution before file access, also known as 'link following,' within the Windows User Profile Service. Successful exploitation allows local attackers to gain administrator privileges. Microsoft’s advisory states that an authenticated attacker with credentials for another local account could execute a specially crafted application to load another user's registry hive. This could grant the attacker access to or modification rights for another user's data, ultimately leading to administrator privileges, with no user interaction required.
Prior to Microsoft's official patch, ACROS Security, through its 0Patch platform, released free unofficial patches for LegacyHive on July 20. These unofficial patches were available for systems running Windows 10 2004 or later and Windows Server 2022 or later.
Following the PoC's release, vulnerability analyst Will Dormann explained that non-administrative users could leverage Nightmare Eclipse's exploit to modify the classes registry hive, leading to automatic code execution when an administrator account logs into a compromised system. Cybersecurity expert Kevin Beaumont also published detection queries for LegacyHive exploitation for Microsoft Defender for Endpoint (MDE) and confirmed the exploit's functionality.
While Microsoft has patched the vulnerability, it has attributed the discovery to an anonymous researcher, rather than Nightmare Eclipse. Nightmare Eclipse has publicly disclosed several other zero-day vulnerabilities since April 2026, including ShieldBreak, RoguePlanet, YellowKey, BlueHammer, RedSun, GreenPlasma, MiniPlasma, and UnDefend, affecting components such as Microsoft Defender, BitLocker, and other Windows services. Microsoft previously patched YellowKey, GreenPlasma, and MiniPlasma in June 2026, and RoguePlanet in July, but other disclosed flaws remain unpatched.
