Back Feeds.4Sysops

LegacyHive exploit targets Windows User Profile Service after July updates

Feeds.4Sysops •IT News • July 15, 2026

A security researcher has released a proof-of-concept exploit named LegacyHive that targets the Windows User Profile Service (ProfSvc). This vulnerability allows for local elevation of privileges by forcing the system-level service to load arbitrary registry hives. The exploit remains functional on all currently supported versions of Windows desktop and server, even after applying the July 2026 Patch Tuesday updates. Source

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

LegacyHive Exploit Targets Windows User Profile Service Zero-Day Vulnerability On July 15, 2026, security researcher Nightmare Eclipse released a proof-of-concept exploit named LegacyHive, targeting a zero-day vulnerability in the Windows User Profile Service (ProfSvc). This flaw allows arbitrary registry hive loading, enabling privilege escalation and unauthorized access to user data. The exploit affects all supported versions of Windows 10, Windows 11, and Windows Server (2016, 2019, and 2022), even on fully patched systems post-July 2026 Patch Tuesday. The PoC demonstrates a dangerous primitive that could be weaponized for more severe attacks. The exploit requires credentials for a secondary user and manipulates registry paths to achieve its goals. Although the PoC is limited, it poses a significant risk due to its sophistication and the timing of its release. The vulnerability was not addressed in the recent patch cycle, leaving systems exposed. 16 sources 71

Extracted Entities

LegacyHive exploit targets Windows User Profile Service after July updates

The full story

Extracted Entities

MITRE ATT&CK (1)

Platforms (1)

Vulnerabilities (1)