New LegacyHive Windows 0-day Vulnerability Allows Users to Load Another User’s Registry

Cybersecuritynews •Abinaya • July 15, 2026

A proof-of-concept exploit dubbed LegacyHive has been released, enabling a Windows elevation-of-privilege vulnerability in the Windows User Profile Service that allows a standard user to load another user’s registry hive under their own registry classes root. Registry hives are files that store configuration data for Windows, services, applications, and user profiles. Improperly loading or exposing […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

LegacyHive Exploit Targets Windows User Profile Service Zero-Day Vulnerability On July 15, 2026, security researcher Nightmare Eclipse released a proof-of-concept exploit named LegacyHive, targeting a zero-day vulnerability in the Windows User Profile Service (ProfSvc). This flaw allows arbitrary registry hive loading, enabling privilege escalation and unauthorized access to user data. The exploit affects all supported versions of Windows 10, Windows 11, and Windows Server (2016, 2019, and 2022), even on fully patched systems post-July 2026 Patch Tuesday. The PoC demonstrates a dangerous primitive that could be weaponized for more severe attacks. The exploit requires credentials for a secondary user and manipulates registry paths to achieve its goals. Although the PoC is limited, it poses a significant risk due to its sophistication and the timing of its release. The vulnerability was not addressed in the recent patch cycle, leaving systems exposed. 16 sources 71

Extracted Entities

New LegacyHive Windows 0-day Vulnerability Allows Users to Load Another User’s Registry

The full story

Extracted Entities

Attack Types (1)

MITRE ATT&CK (2)

Platforms (1)

Vulnerabilities (1)