Microsoft shipped 570 patches on July 14. Your Windows machine is still vulnerable. A researcher released a working proof-of-concept the same day that targets every supported Windows version — 10, 11, and Server — and as of today, there is no CVE number, no Microsoft advisory, and no official fix. A third-party micropatch from 0patch has been available since July 20.
What LegacyHive Does
LegacyHive exploits a flaw in the Windows User Profile Service (ProfSvc) — the same component Microsoft patched for the same class of vulnerability in 2015 (MS15-003). The exploit lets a standard local user mount an administrator’s registry hive inside their own user context. Once that hive is open, the attacker can hijack file type associations, modify COM object registrations, and plant code that runs the next time the admin logs in — all appearing to originate from the legitimate admin account.
Security researcher Will Dormann called it “a pretty powerful primitive.” Cyderes SVP Brian Hussey put it plainly: “LegacyHive does not break in from outside. It is built for the person already sitting at the machine next to yours, and that makes it a different kind of problem than the privilege escalation bugs we usually see.”
The public proof-of-concept is intentionally stripped. Researcher Nightmare Eclipse confirmed the original exploit needed no additional credentials and was not limited to one hive file. What is public is already dangerous. What remains private is worse.
One detail that makes this harder to detect: the exploit cleans up after itself. It restores original hive files and removes staging artifacts on exit. After a successful attack, the disk is clean.
No CVE Is the Real Problem
LegacyHive has no CVE identifier. That is not a minor detail. Vulnerability scanners run on CVE indexes. Patch management platforms report on CVEs. SIEM alert rules correlate on CVE numbers. Without one, security tooling cannot report that your systems are exposed, regardless of how many automated checks you run.
This is the CVE shadow problem: a real, weaponized, publicly disclosed vulnerability that is architecturally invisible to compliance-based security programs. Checking the vulnerability management dashboard and seeing green does not mean you are protected. It means your tooling has a blind spot the size of this exploit.
The Fix That Exists (Not From Microsoft)
ACROS Security released a free 0patch micropatch for LegacyHive on July 20, 2026. It covers Windows 10 version 2004 and later, plus Windows Server 2022 and later. No system restart required.
The micropatch intercepts the exploit’s hive-loading API call and substitutes a temporary profile hive in place of the target user’s real hive. ACROS CEO Mitja Kolsek confirmed: “the exploit still seems to work, but it loads a temporary user profile hive instead of that from adminuser.” In practice, the attacker gets nothing useful.
To install: create a free account at 0patch.com, download the 0patch agent, and let it run. The micropatch deploys automatically with no reboot.
The Researcher Behind This (and Why It Keeps Happening)
Nightmare Eclipse — also operating as Chaotic Eclipse and MSNightmare — is widely reported to be a former Microsoft security employee who departed in 2025. The researcher claims Microsoft violated a coordinated disclosure agreement, systematically ignored internal vulnerability reports, and deleted submission accounts. LegacyHive is the ninth Windows zero-day Nightmare Eclipse has released in 2026. Only one (BlueHammer) has received an official patch.
The 2015 connection matters. CVE-2015-0004 patched this exact ProfSvc trust-boundary failure — a vulnerability that let a local user load another user’s UsrClass.dat hive via a junction attack. LegacyHive exploits the same component with the same mechanism. Microsoft either did not fully fix the root cause in 2015 or introduced a regression across eleven years of updates. The same architectural weakness is back.
What to Do Before Microsoft Acts
Install the 0patch micropatch immediately. Beyond that, these measures reduce exposure on multi-user Windows systems:
- Restrict secondary local user accounts on servers and shared workstations
- Enable auditing on profile hive files (ntuser.dat, UsrClass.dat) and alert on unexpected writes
- Monitor Windows Security Event IDs 4648, 4663, and 4688
- Alert on GUID-named directories created directly under C:\
- Use EDR behavioral rules to catch NtCreateDirectoryObjectEx and NtCreateSymbolicLinkObject calls from non-system processes
ThreatLocker users can enable detection policy TL.EV.1827 for automated LegacyHive detection.
Do not wait for Microsoft. They have not committed to a patch timeline, and the Nightmare Eclipse campaign shows no signs of stopping. Behavioral detection and interim micropatching are what protect you in the gap between disclosure and an official fix — whenever that arrives.
