Microsoft Patches LegacyHive Windows Zero-Day That Grants Admin Privileges

Microsoft has patched a publicly disclosed Windows zero-day known as LegacyHive as part of the August 2026 Patch Tuesday, now tracked as CVE-2026-62832. The vulnerability lives in the Windows User Profile Service and allows a regular non-admin local user to mount another user's registry hive, extract stored secrets, or manipulate registry values to trigger code execution when an admin logs in — effectively gaining full administrator privileges.

The flaw was disclosed by a researcher under the handle "Nightmare Eclipse" who published a proof-of-concept exploit just hours after the July 2026 Patch Tuesday, reportedly as a protest against Microsoft's bug bounty and disclosure practices. Microsoft credited the discovery to an "anonymous researcher" in its advisory.

Vulnerability Details

Affected Versions

• Windows 10 version 2004 and later
• Windows Server 2022 and newer
• Full scope per the Microsoft Security Response Center advisory

How LegacyHive Works

The Windows User Profile Service manages registry hives — the per-user registry data loaded during login. The vulnerability stems from improper link resolution (a "link following" flaw) in how the service handles registry hive paths.

A local non-admin user can exploit this to:

1. Identify a target user account (e.g. an administrator) on the same machine
2. Use credentials for another local account to trigger the vulnerable code path
3. Mount the target user's registry hive with full access
4. Option A: Extract stored credentials or secrets from the mounted hive
5. Option B: Modify registry values in the classes hive
6. When the admin next logs in, the modified registry triggers automatic code execution
7. Attacker gains full administrator privileges

As described by 0patch, the flaw "allows a regular non-admin user to mount any other user's registry hive in full access mode, and then either extract that user's stored secrets or modify any values in their registry to affect what gets executed the next time they log in."

Principal vulnerability analyst Will Dormann (Tharros) confirmed that non-admin users could use the technique to "gain automatic code execution" when an admin logs into the compromised device.

Timeline

August 2026 Patch Tuesday Context

The August 2026 Patch Tuesday was one of Microsoft's largest in recent memory, addressing over 400 vulnerabilities including:

• 3 zero-days (including LegacyHive/CVE-2026-62832, one actively exploited, one publicly disclosed)
• 42 Critical vulnerabilities — 37 Remote Code Execution, 5 Elevation of Privilege
• Flaws across Windows, Office, Azure, Exchange, and Edge

Detection

Kevin Beaumont published detection queries for Microsoft Defender for Endpoint (MDE) the day after the PoC was released. If your organization runs MDE, hunting for LegacyHive exploitation attempts is recommended even for unpatched systems to determine if exploitation occurred before the patch.

// KQL query concept for MDE — User Profile Service anomalies
DeviceEvents
| where ActionType == "RegistryValueSet"
| where RegistryKey contains "Software\\Classes"
| where InitiatingProcessAccountName != RegistryValueName
| project Timestamp, DeviceName, InitiatingProcessAccountName, RegistryKey, RegistryValueName

Immediate Actions

1. Apply August 2026 Patch Tuesday updates — the official fix for CVE-2026-62832
2. Verify patch deployment — confirm all Windows 10 (2004+) and Server 2022+ systems are updated
3. Run MDE threat hunting using Kevin Beaumont's detection queries if available
4. Restrict local account usage — limit the number of accounts with credentials stored locally
5. Review administrator login patterns — unusual admin logins post-compromise may indicate exploitation

If Immediate Patching Is Not Possible

Organizations that cannot apply the patch immediately should consider the 0patch unofficial micropatch as a temporary measure. 0patch released free micropatches covering Windows 10 version 2004+ and Windows Server 2022+ that remain in effect until the official update is applied.

References

• BleepingComputer — Microsoft patches LegacyHive Windows zero-day vulnerability
• BleepingComputer — Windows LegacyHive zero-day flaw gets free, unofficial patches
• BleepingComputer — Microsoft August 2026 Patch Tuesday fixes 400 flaws, 3 zero-days
• CyberSecurityNews — New Windows LegacyHive 0-Day Vulnerability Allows Hackers to Gain Admin Access
• Help Net Security — Microsoft patches 400+ vulnerabilities (CVE-2026-68820)

Related Reading

• CVE-2026-14182: WooCommerce Email Verification Bypass Allows Account Takeover