Free unofficial patches are now available for a recently disclosed Windows zero-day vulnerability known as LegacyHive, which allows attackers to escalate privileges on updated Windows systems. The vulnerability, lacking a CVE ID for tracking, was identified by a security researcher using the handle Nightmare Eclipse within the Windows User Profile Service.
Nightmare Eclipse disclosed the flaw on the same day Microsoft released its July 2026 Patch Tuesday updates. The researcher also provided a stripped proof-of-concept (PoC) exploit to complicate efforts by threat actors to weaponize the vulnerability.
Will Dormann, principal vulnerability analyst at Tharros, reported that non-admin users can exploit LegacyHive to modify the classes registry hive. This enables automatic code execution when an admin account logs into a compromised device.
Cybersecurity expert Kevin Beaumont confirmed the exploit’s functionality one day after the PoC’s release. He also published queries to detect LegacyHive exploitation for Microsoft Defender for Endpoint.
A Microsoft spokesperson stated, “Microsoft is aware of the reported vulnerability and is actively investigating the validity and potential applicability of these claims.” They added, “Microsoft is committed to investigating security issues and updating impacted products to protect customers as soon as possible.”
Despite Microsoft not yet assigning a CVE ID or issuing security updates for the LegacyHive flaw, ACROS Security has made unofficial patches available through its 0Patch cybersecurity platform. ACROS Security CEO Mitja Kolsek explained, “The vulnerability allows a regular non-admin user to mount any other user’s registry hive in full access mode, and then either extract that user’s stored secrets or modify any values in their registry to affect what gets executed the next time they log in.”
Kolsek noted that with 0Patch enabled, the exploit still functions but loads a temporary user profile hive instead of that of the administrator, rendering the attack ineffective.
The security flaw is limited to systems running Windows 10 version 2004 and later, as well as Windows Server 2019 and later. ACROS Security offers micropatches for Windows 10 2004 or later and Windows Server 2022 or later.
To install the free micropatch, users must register for a 0Patch account and install the 0Patch agent. If there are no custom patching policies blocking it, the patch will be deployed automatically without requiring a system restart.
Nightmare Eclipse has previously disclosed multiple zero-day exploits affecting Microsoft Defender, BitLocker, and various Windows components, including the vulnerabilities RoguePlanet, BlueHammer, RedSun, YellowKey, GreenPlasma, MiniPlasma, and UnDefend. Microsoft addressed the YellowKey, GreenPlasma, and MiniPlasma flaws in last month’s June 2026 Patch Tuesday updates, while the RoguePlanet vulnerability was fixed in the July security updates. Other vulnerabilities disclosed by Nightmare Eclipse remain unpatched.
