LegacyHive: Nightmare Eclipse's Ninth Zero-Day Pierces Fully Patched Windows

Nightmare Eclipse, also known as Chaotic Eclipse, released a zero-day exploit dubbed LegacyHive on July 14, 2026 — hours after Microsoft's Patch Tuesday — that enables local privilege escalation on all supported versions of Windows 10, Windows 11, and Windows Server, including systems updated with the July patches. The researcher intentionally limited the public proof-of-concept, which now requires a second standard user's credentials, but stated the original version had no such constraint and could load arbitrary hives without restriction.

The Mechanism: How Registry Hive Loading Gets Hijacked

The vulnerability resides in the Windows User Profile Service (ProfSvc), the system component responsible for loading user profiles during logon. The service loads the HKEY_USERS\ _Classes hive from the UsrClass.dat file in the user's profile. Nightmare Eclipse's exploit manipulates this flow through a chain of three interdependent mechanisms.

The first element is offline registry hive modification. The attacker prepares a modified hive file to be loaded in place of the legitimate one. The second is Object Manager symbolic link redirection: via the NtCreateSymbolicLinkObject and NtCreateDirectoryObjectEx APIs, the exploit creates a symbolic link in the Windows Object Manager namespace that redirects the ProfSvc's expected load path to an attacker-controlled destination. The third mechanism is synchronization via opportunistic lock (oplock), a Windows file system primitive that allows a process to receive notifications when another process attempts to access a file. The oplock lets the attacker precisely time the path swap at the exact moment ProfSvc opens the hive.

The result is cross-user hive redirection: an unprivileged user mounts another user's UsrClass.dat — including an administrator's — into their own HKU\ _Classes namespace, gaining read access and the ability to modify class associations that trigger upon the victim's logon. Will Dormann, principal vulnerability analyst at Tharros, confirmed this technique allows non-admin users to modify an administrator account's classes registry hive, resulting in automatic code execution at logon.

"For example, as a novelty, we can associate .txt files to open with calc.exe. Clever attackers or people who want to accomplish something will easily be able to figure out how to do things that are more interesting and/or don't even require user interaction."
— Will Dormann, principal vulnerability analyst, Tharros

The "Stripped-Down" PoC: A Disclosure Tactic Under Pressure

Nightmare Eclipse released a deliberately limited version of the exploit. According to the researcher's statement reported by BleepingComputer, "the PoC was stripped down as an attempt to prevent public exploitation, the original PoC did not require additional user credential and was not limited to usrclass.dat hive, any hive could be loaded using this vulnerability." This choice introduces a new pattern in the adversarial relationship between the researcher and Microsoft.

The researcher specified the public PoC "requires another standard user credentials and a third username (which can be an administrator account), if the PoC is successful, it will end up mounting the target user hive in current user classes root." The secondary credential requirement reduces opportunistic exploitability — it does not allow escalation from a single compromised account — but does not neutralize the risk in multi-user environments such as terminal servers, RDS, or shared workstations where an attacker already has access to multiple accounts.

The artificial PoC limit raises questions about the function of responsible disclosure when the researcher acknowledges no coordinated obligation. In three months, Nightmare Eclipse has published 9 Windows exploits without coordinated disclosure: BlueHammer, UnDefend, RedSun, RoguePlanet, YellowKey, GreatXML, GreenPlasma, MiniPlasma, and now LegacyHive. The number of vulnerabilities Microsoft patched in the same July 2026 Patch Tuesday hit a monthly record, but the dossier does not establish a direct causal link between the researcher's releases and the patch volume.

Independent Confirmations and Available Detection

The security community has independently verified the exploit's functionality. Kevin Beaumont, known for his Windows security analyses, confirmed "the LegacyHive exploit works" and published detection queries for Microsoft Defender for Endpoint. ThreatLocker confirmed the PoC mounts a target's UsrClass.dat with read access in another user account. Cyderes Howler Cell described the technique as abuse of the profile loading logic causing an unintended UsrClass.dat to load into the HKU\ _Classes namespace.

Rescana provided a technical deep-dive including indicators of compromise: anomalous API calls to NtCreateSymbolicLinkObject and NtCreateDirectoryObjectEx, presence of hive files in non-standard paths, and oplock access patterns on .dat files in profile directories. The source does not specify whether these IoCs are sufficient to detect the unreleased original version of the PoC.

Matei Badanoiu, lead security researcher at Pentest-Tools.com, summarized the technique as "local privilege escalation in the Windows User Profile Service. It abuses arbitrary registry hive loading, so a standard user can mount another user's hive, including an administrator's, into their own classes root." Dray Agha of Huntress contributed to the critical analysis of the PoC, though the dossier does not report a specific statement from this source on the technical functioning.

Why It Matters

Microsoft is aware of the vulnerability and is investigating. A spokesperson told BleepingComputer: "Microsoft is aware of the reported vulnerability and is actively investigating the validity and potential applicability of these claims." At the time of publication, no patch is available and no CVE ID has been assigned to the LegacyHive vulnerability.

The dossier does not specify whether Microsoft has communicated a timeline for a fix. No evidence of in-the-wild exploitation has emerged. Nightmare Eclipse's real identity remains unverified: an unconfirmed hypothesis suggests a former Microsoft engineer, but the dossier documents no evidence supporting this attribution.

The brief does not list specific mitigations or detailed operational recommendations from the vendor. The source does not specify the full nature of exposed data beyond read access to the target hive. The dossier does not document whether the original PoC version allowed write modifications to the hijacked hive or only read access.

The Serialized Patch Tuesday Paradox

LegacyHive's release hours after a record Patch Tuesday — 622 vulnerabilities fixed by Microsoft in the same monthly cycle — highlights a structural dynamic: the researcher has learned to maximize exposure time by exploiting the inherent delay in monthly patch cycles. Each release in this window generates roughly 30 days of uncovered vulnerability, regardless of the volume of simultaneous fixes. The pattern of 9 zero-days in three months suggests a systematic approach that transcends any single discovery.

The "stripped" PoC choice can be read two ways: as a form of responsible self-limitation in the absence of functioning disclosure channels, or as negotiating pressure to accelerate vendor response. The dossier does not document which reading is correct, nor whether direct contact exists between the researcher and Microsoft. What remains documented is the convergence of a verified technical mechanism, serialized disclosure, and a defense ecosystem that must now proactively monitor for a vulnerability with no CVE identifier and no available patch.

Sources

• https://www.bleepingcomputer.com/news/security/new-windows-legacyhive-zero-day-exploit-grants-hackers-admin-access/
• https://thehackernews.com/2026/07/researcher-drops-new-windows-zero-day.html
• https://www.rescana.com/post/critical-windows-10-11-and-server-zero-day-legacyhive-exploit-enables-privilege-escalation-via-user-profile-service-vuln
• https://www.theregister.com/security/2026/07/15/microsofts-serial-tormentor-drops-legacyhive-0-day/5271723
• https://www.cve.org/CVERecord?id=CVE-2026-32201
• https://www.cisa.gov/news-events/alerts/2026/07/14/cisa-adds-four-known-exploited-vulnerabilities-catalog
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• https://www.cisa.gov/news-events/alerts/2026/07/14/cisa-urges-sharepoint-hardening-after-new-exploitations
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55040

Information based on cited sources and current as of publication.

Sources