BleepingComputer • 8h
Microsoft Windows LegacyHive ProfSvc Zero-Day LPE
The LegacyHive vulnerability is a critical Local Privilege Escalation (LPE) flaw within the Windows User Profile Service (ProfSvc) affecting fully patched Windows desktop and server environments. Disclosed by researcher Nightmare Eclipse shortly after the July 2026 Patch Tuesday, the exploit enables attackers with local access to bypass security controls by unauthorizedly loading and unloading other users' registry hives. This mechanism allows for the extraction of sensitive application data and Windows Explorer history, providing a direct path to escalate privileges to the administrative level.