Back Securityaffairs.Co

Chaotic Eclipse Unveils LegacyHive Exploit Affecting Fully Patched Windows Systems

Securityaffairs.Co •Pierluigi Paganini • July 15, 2026

LegacyHive PoC exposes a Windows Privilege Escalation flaw affecting fully patched Windows desktop and server systems. Just hours after Microsoft’s July 2026 Patch Tuesday, security researcher Nightmare Eclipse, also known as Chaotic Eclipse, published a new Windows zero-day proof-of-concept called LegacyHive. This time, the target is the Windows User Profile Service (ProfSvc), and unlike the […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

LegacyHive Exploit Targets Windows User Profile Service Zero-Day Vulnerability On July 15, 2026, security researcher Nightmare Eclipse released a proof-of-concept exploit named LegacyHive, targeting a zero-day vulnerability in the Windows User Profile Service (ProfSvc). This flaw allows arbitrary registry hive loading, enabling privilege escalation and unauthorized access to user data. The exploit affects all supported versions of Windows 10, Windows 11, and Windows Server (2016, 2019, and 2022), even on fully patched systems post-July 2026 Patch Tuesday. The PoC demonstrates a dangerous primitive that could be weaponized for more severe attacks. The exploit requires credentials for a secondary user and manipulates registry paths to achieve its goals. Although the PoC is limited, it poses a significant risk due to its sophistication and the timing of its release. The vulnerability was not addressed in the recent patch cycle, leaving systems exposed. 16 sources 71

Extracted Entities

Chaotic Eclipse Unveils LegacyHive Exploit Affecting Fully Patched Windows Systems

The full story

Extracted Entities

Attack Types (1)

CWE Weaknesses (1)

MITRE ATT&CK (1)

Platforms (1)

Vulnerabilities (1)