Microsoft Patches LegacyHive Windows User Profile Logic Vulnerability
Microsoft has patched LegacyHive, a logic-based local privilege escalation (LPE) primitive targeting the Windows User Profile Service (ProfSvc). The vulnerability allows a low-privileged attacker to redirect the loading of a target user's UsrClass.dat registry hive into their own namespace via Object Manager symbolic link redirection and synchronized profile loading. This primitive enables unauthorized cross-user access to sensitive registry data, including application configurations and Windows Explorer history. While initially disclosed as a zero-day by researcher NightmareEclipse and verified by Cyderes' Howler Cell, the flaw is now addressed in a recent massive security update cycle.
Microsoft Windows LegacyHive ProfSvc Zero-Day LPE
The LegacyHive vulnerability is a critical Local Privilege Escalation (LPE) flaw within the Windows User Profile Service (ProfSvc) affecting fully patched Windows desktop and server environments. Disclosed by researcher Nightmare Eclipse shortly after the July 2026 Patch Tuesday, the exploit enables attackers with local access to bypass security controls by unauthorizedly loading and unloading other users' registry hives. This mechanism allows for the extraction of sensitive application data and Windows Explorer history, providing a direct path to escalate privileges to the administrative level.
Linux Kernel: DirtyFrag and DirtyClone Local Privilege Escalation Vulnerabilities
The Linux kernel is affected by a series of critical local privilege escalation (LPE) vulnerabilities known as the DirtyFrag family, specifically DirtyClone (CVE-2026-43503) and CVE-2026-53130. DirtyClone leverages cloned network packets to corrupt file-backed memory, enabling attackers to rewrite executable code in memory to achieve root privileges without leaving traces on the physical disk. DirtyFrag involves memory corruption within the rxrpc (Remote XDR RPC) and ESP (Encapsulating Security Payload) subsystems. These vulnerabilities allow unprivileged local users to bypass kernel security boundaries for full system compromise. Remediation requires immediate application of patches provided by Linux kernel maintainers.
Linux Kernel: Critical Local Privilege Escalation via Bad Epoll CVE-2026-46242
CVE-2026-46242, dubbed "Bad Epoll," is a critical local privilege escalation (LPE) vulnerability residing in the Linux kernel's epoll subsystem within fs/eventpoll.c. The flaw allows an unprivileged local attacker to trigger a memory corruption primitive, granting full root-level access to the host system. This vulnerability impacts a vast ecosystem, including enterprise Linux servers, desktop distributions, and the Android mobile operating system. Remediation requires applying the official patches from the Linux kernel stable tree. This case notably highlights the limitations of AI-driven vulnerability research, as the 'Mythos' AI model failed to detect this specific flaw despite auditing the same code segment.
Linux Kernel CVE-2026-23111: One-Character Flaw Enables Local Root Access
CVE-2026-23111 is a critical Use-After-Free (UAF) vulnerability in the Linux kernel's nf_tables subsystem, triggered by a single-character logic error during memory deallocation. This flaw allows unprivileged local users to perform heap grooming to overwrite process cred structures, achieving Local Privilege Escalation (LPE) to root. Furthermore, the vulnerability enables container escapes within Docker and Kubernetes environments by bypassing namespace isolation. Following the release of a functional exploit by Exodus Intelligence on June 8, 2026, the risk to unpatched Linux distributions and cloud-native infrastructures is severe. Organizations must prioritize kernel updates or restrict unprivileged user namespaces to mitigate this threat.