LegacyHive Exploit Targets Windows User Profile Service for Privilege Escalation

A proof-of-concept exploit named LegacyHive has been released, targeting the Windows User Profile Service (ProfSvc). This vulnerability allows local elevation of privileges, enabling standard users to load another user's registry hive. The exploit remains functional across all currently supported versions of Windows desktop and server, even after the July 2026 Patch Tuesday updates. The vulnerability poses a significant risk as it can be exploited without requiring administrative privileges. Security researchers have confirmed that the exploit can lead to unauthorized access to sensitive user data. Organizations using affected Windows systems are advised to monitor for potential exploitation. No specific CVEs have been assigned yet, but the exploit is considered a serious threat. The situation is evolving, and further updates may be necessary as more information becomes available.

Key Points: • LegacyHive exploit allows privilege escalation on Windows User Profile Service. • The vulnerability affects all supported versions of Windows desktop and server. • No CVEs assigned yet, but the exploit poses a significant risk to user data.