Full research report
Microsoft patches LegacyHive Windows zero-day vulnerability
Executive assessment
CVE-2026-62832 (LegacyHive) is a local privilege escalation in the Windows User Profile Service caused by a link-following weakness that allows a coerced registry hive load with unintended full-access permissions, affecting Windows 10 through Windows 11 and Server 2022/2025. Researcher Nightmare Eclipse deliberately published a stripped PoC on 14–15 July 2026 requiring two local account credentials, a design choice that materially limits opportunistic exploitation relative to a credential-free variant; the researcher stated the original unreleased version required no additional credentials. No active exploitation has been confirmed—the flaw is absent from the CISA KEV catalogue, its EPSS score of 2.4% reflects moderate near-term exploitation probability, and the confirmed-exploited zero-day in the August 2026 Patch Tuesday was an unrelated afd.sys flaw (CVE-2026-68820). Microsoft's official patch shipped in August 2026, with ACROS Security's no-reboot 0patch micropatch providing interim coverage from 20 July. The broader context of Nightmare Eclipse's ongoing disclosure campaign—nine Windows vulnerabilities since April 2026, several still awaiting official patches—represents a continued researcher-driven pressure on Microsoft's disclosure and bounty processes that defenders should monitor for further unpatched zero-day releases.
What happened
Security researcher Nightmare Eclipse published a proof-of-concept exploit for LegacyHive on 14–15 July 2026, hours after the July Patch Tuesday, as a deliberate protest against Microsoft's bug bounty and vulnerability disclosure practices. The flaw—a link-following weakness in the Windows User Profile Service—allows an authenticated local attacker holding credentials for a second local account to coerce the service into loading that user's registry hive with elevated permissions, enabling privilege escalation to administrator level. Microsoft acknowledged the report, and ACROS Security released a free interim micropatch on 20 July 2026. Microsoft issued an official fix in the August 2026 Patch Tuesday, assigning the identifier CVE-2026-62832.
Affected scope
Windows 10 21H2 and 22H2, Windows 11 23H2 through 26H1, Windows Server 2022 and Windows Server 2025; the vulnerable boundary is the Windows User Profile Service registry hive-loading subsystem across all supported releases
Technical assessment
The vulnerability is a link-following weakness (CWE-59) in the User Profile Service that allows a specially crafted application to coerce the service into mounting a target user's registry hive (usrclass.dat) with full-access permissions beyond the intended boundary. Vulnerability analyst Will Dormann characterised the resulting primitive as 'pretty powerful' because it enables modification of file associations belonging to another user, including administrators, potentially enabling persistent code execution upon that user's next logon. The public PoC is intentionally stripped by the researcher to require credentials for a second local standard user account; the original unreleased version reportedly required no additional credentials. Kevin Beaumont confirmed the stripped PoC functioned and published Defender for Endpoint detection queries approximately one day after the PoC was released. CVSS 7.8 (High) and EPSS 2.4% reflect meaningful severity alongside moderate near-term exploitation probability.
Recommended defensive actions
- Apply the August 2026 Microsoft Patch Tuesday update for CVE-2026-62832 to all affected Windows 10, 11, and Server systems as the primary remediation
- Deploy the ACROS Security 0patch micropatch via central.0patch.com for any system that cannot receive the official patch immediately—no reboot is required
- Monitor User Profile Service registry hive-load events using the Defender for Endpoint (MDE) detection queries published by Kevin Beaumont approximately 16 July 2026
- Restrict local interactive account access and audit which non-administrator accounts hold credentials for other local accounts, as the stripped PoC requires two local account credentials to execute
Uncertainties and evidence gaps
- Whether an unstripped, credential-free variant of the PoC will be published by Nightmare Eclipse or independently derived by threat actors, which would materially lower the exploitation barrier
- Microsoft attributed the discovery to 'anonymous researcher' rather than Nightmare Eclipse, leaving the researcher–vendor attribution dispute unresolved and potentially influencing future disclosure behaviour
- Several other Nightmare Eclipse zero-days disclosed since April 2026—including ShieldBreak, BlueHammer, RedSun, and UnDefend—remain without official Microsoft patches, and their active exploitation status was not addressed in this reporting cycle
Vulnerability flow
Defender-oriented path reconstructed only from sourced report findings. Unknown stages are omitted.
No confirmed active exploitation; a stripped public PoC was released by Nightmare Eclipse on 14–15 July 2026 requiring credentials for a second local account, reducing near-term weaponisation risk; Microsoft assessed exploitation as likely and the flaw is not listed on the CISA KEV catalogue
Investigation began with the BleepingComputer report of an official August 2026 patch for LegacyHive, establishing the CVE assignment and mechanism. Cross-referencing SecurityWeek's initial disclosure coverage and The Hacker News write-up confirmed the PoC timeline, its intentional credential-requiring limitation, and independent expert validation by Will Dormann and Kevin Beaumont. The SecurityWeek Patch Tuesday analysis and Mallory.ai CVE record then established that no active exploitation was confirmed, the CISA KEV was not triggered, and CVSS 7.8 with EPSS 2.4% reflected moderate near-term risk. The evidence supports a publicly disclosed, officially patched local privilege escalation with a limited-capability PoC and no confirmed in-the-wild exploitation as of August 2026.
- What does the primary source report about the patch, CVE assignment, and technical mechanism?Fetched the BleepingComputer article on the official LegacyHive patchbleepingcomputer.com ↗
CVE-2026-62832 assigned in August 2026 Patch Tuesday; link-following flaw in Windows User Profile Service; Nightmare Eclipse released a stripped PoC 14–15 July 2026; 0patch available from 20 July; Microsoft attributed the find to 'anonymous researcher'
why Established baseline event facts and confirmed the primary claim of an official patch with Microsoft's own characterisation of the flaw
- Do independent outlets corroborate the CVE and exploitation status?Searched for CVE-2026-62832 across security news outlets
SecurityWeek, Malwarebytes, CrowdStrike and others confirmed the August 2026 Patch Tuesday context; CVE-2026-62832 described as publicly disclosed with exploitation 'likely' but not confirmed; only CVE-2026-68820 (afd.sys) was confirmed actively exploited in the same cycle
why Established independent corroboration from multiple domains and separated LegacyHive's exploitation status from the confirmed-exploited zero-day in the same Patch Tuesday
- What are the full technical details of the PoC release and researcher motivation?Fetched SecurityWeek article on Nightmare Eclipse's initial disclosuresecurityweek.com ↗
PoC released in protest of Microsoft's bug bounty practices; intentionally stripped to require credentials for a second local account; original version required no credentials; target is usrclass.dat hive via ProfSvc
why Established the deliberate limitation of the public PoC, reducing immediate weaponisation risk, and confirmed researcher attribution and motive
- What is confirmed about LegacyHive's exploitation status in the August 2026 Patch Tuesday context?Fetched SecurityWeek Patch Tuesday analysissecurityweek.com ↗
Microsoft flagged CVE-2026-62832 as publicly disclosed and likely to be exploited; no active exploitation confirmed; confirmed-exploited zero-day in the August cycle was CVE-2026-68820, not LegacyHive
why Confirmed that 'exploitation likely' is Microsoft's forward assessment rather than a confirmed event, preventing overstating the threat level
- What are the precise affected Windows versions and quantitative risk metrics?Fetched the Mallory.ai CVE record for CVE-2026-62832mallory.ai ↗
CVSS 7.8 (High), EPSS 2.4% at the 82nd percentile; not in CISA KEV; affects Windows 10 21H2/22H2, Windows 11 23H2–26H1, Server 2022 and 2025; no observed wild exploitation
why Provided precise version scope and quantitative risk metrics from an aggregated CVE source, noting that Mallory did not record a formal exploit entry, which the BleepingComputer and THN reporting resolves as referring to exploit-database indexing rather than absence of a PoC
- What did independent security experts say about the PoC's technical impact and detection?Fetched The Hacker News write-up on the PoC releasethehackernews.com ↗
Will Dormann described the primitive as 'pretty powerful' for file-association manipulation; Kevin Beaumont confirmed the exploit worked and published MDE detection queries; researcher intentionally limited public PoC to usrclass.dat loading
why Independent expert validation of technical impact and confirmation of an available detection capability provided defenders with concrete response options
- What does the ACROS Security 0patch cover and how does it work?Fetched BleepingComputer article on unofficial 0patch micropatchbleepingcomputer.com ↗
Micropatch released 20–21 July 2026 for Windows 10 2004+, Server 2019/2022+; intercepts the vulnerable code path and redirects the load to a temporary hive rather than the target user's; no reboot required; ACROS CEO Mitja Kolsek confirmed the mechanism
why Established a verified interim mitigation path with sourced technical detail for organisations unable to wait for the official August patch
Research coverage
All 68 registered source leaves were evaluated for this run: 61 completed, 0 were unavailable, 0 failed and 7 were disabled. For this story, 1 registered sources supplied useful evidence (1 primary, 0 corroborating, 0 contextual and 0 PoC/exploit references). 60 completed sources contained no matched information for this story.
Complete source-by-source audit 68 sources
| Source | Run result | Value | Why it was useful — or not |
|---|---|---|---|
| BleepingComputernews | ok11 records | Primary evidence3 matched items | Published the source report used to frame and date the event. Supplied a vendor or government advisory opened and verified during focused research. |
| AlienVault OTXdark_web | ok10 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| CIRCL CVEcve | ok30 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| CISA Alertsnews | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| CISA KEVkev | ok1665 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Cisco PSIRTvendor_advisory | ok5324 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Cisco Talosnews | ok2 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI CVE most exploiteddeepdarkcti | ok94 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI Discorddeepdarkcti | ok7 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI exploitsdeepdarkcti | ok24 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI forumsdeepdarkcti | ok264 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI malware as a servicedeepdarkcti | ok7 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI malware samplesdeepdarkcti | ok3 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI marketsdeepdarkcti | ok127 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI phishingdeepdarkcti | ok19 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI ransomware gangsdeepdarkcti | ok682 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI RATsdeepdarkcti | ok1 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI Telegram infostealerdeepdarkcti | ok130 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI Telegram threat actorsdeepdarkcti | ok1008 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI Twitter threat actorsdeepdarkcti | ok39 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| DNSDumpster domain IOC enrichmentresearch | ok1 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Exploit-DBexploit_reference | ok1 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| FIRST EPSSepss | ok7640 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Fortinet PSIRTvendor_advisory | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| GitHub topic: cveresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| GitHub topic: exploitresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| GitHub topic: penetration-testingresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| GitHub topic: pocresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| GitHub topic: vulnerabilityresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| GreyNoiseexploit_reference | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| KrebsOnSecuritynews | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| LinkedIn RSS proxy feeds (disabled)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| MalwareBazaardark_web | ok5 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #cveresearch | ok20 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #cybersecurityresearch | ok12 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #exploitresearch | ok17 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #infosecresearch | ok20 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #malwareresearch | ok20 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #ransomwareresearch | ok20 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #threatintelresearch | ok20 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #vulnerabilityresearch | ok18 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Metasploit module metadataexploit_reference | ok2 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Microsoft MSRCvendor_advisory | ok1590 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Microsoft Securitynews | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| MISP Galaxyresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| MISP threat actor galaxyactor | ok0 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| NVDcve | ok900 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Palo Alto Networks PSIRTvendor_advisory | ok25 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| ProjectDiscovery nuclei templatesexploit_reference | ok1 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Rapid7news | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Reddit r/AskNetsec (pending API approval)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| Reddit r/cybersecurity (pending API approval)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| Reddit r/malware (pending API approval)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| Reddit r/netsec (pending API approval)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| Reddit r/ReverseEngineering (pending API approval)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| SANS ISCnews | ok1 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Shadowserver public aggregate honeypot observationsexploit_reference | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Shodanresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Sigma Rulesresearch | ok2 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Sophos IOCsresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| The Hacker Newsnews | ok1 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| ThreatFoxthreat_intelligence | ok100 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| UK NCSCnews | ok1 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Unit42 IOCsresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| URLhausdark_web | ok10 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| VirusTotal Community IOC enrichmentresearch | ok4 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| VulnCheck KEVkev | ok500 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Vulnerability Lookupcve | ok30 records | Checked — no match | The source completed, but none of its retained records matched this story. |
Additional verified pages 5 opened outside the registered collection
Technical references3
Repository captured from the source article as technical context; not validated as PoC or exploit code.
Repository captured from the source article as technical context; not validated as PoC or exploit code.
Repository captured from the source article as technical context; not validated as PoC or exploit code.
PoC & exploit code1
Technical write-up confirming PoC released 14–15 July 2026; details credential requirement, usrclass.dat scope, and expert analysis from Will Dormann and Kevin Beaumont
Vendor & gov advisories3
Primary report confirming official August 2026 Patch Tuesday fix tracked as CVE-2026-62832 and Microsoft's statement on the vulnerability
Confirms ACROS Security 0patch micropatch available from 20–21 July 2026, no reboot required, covering Windows 10 2004+ and Server 2019/2022+
Independent Patch Tuesday analysis confirming CVE-2026-62832 as publicly disclosed but not actively exploited; distinguishes LegacyHive from the confirmed-exploited zero-day CVE-2026-68820
Analysis & research2
Details researcher motivation, intentionally stripped PoC design, credential requirements, and technical mechanism targeting usrclass.dat via ProfSvc
Aggregated CVE record confirming CVSS 7.8, EPSS 2.4% at the 82nd percentile, no CISA KEV listing, and precise affected Windows version matrix