Microsoft Patches LegacyHive Windows Zero-Day
Summary
Microsoft patched LegacyHive (CVE-2026-62832), a Windows User Profile Service flaw that can let an authenticated local attacker gain administrator privileges. A proof-of-concept was published before the patch.
Key points
- Microsoft included a patch for LegacyHive in its August 2026 Patch Tuesday updates and tracks the flaw as CVE-2026-62832.
- The flaw involves improper link resolution in the Windows User Profile Service.
- Exploitation requires credentials for another local account; Microsoft says a specially crafted application could load that account’s registry hive and enable privilege escalation.
- Nightmare Eclipse published a proof-of-concept after July 2026 Patch Tuesday; Microsoft initially said it was investigating the reported vulnerability.
- Kevin Beaumont published Microsoft Defender for Endpoint detection queries and said the exploit worked.
- ACROS Security released unofficial 0Patch fixes for Windows 10 2004 or later and Windows Server 2022 or later.
Article Details
- Vulnerability Types
- Improper link resolution before file access (link following)
- Local privilege escalation
- Exploitation Status
- reported
- Exploit Availability
- public_poc
- Patch Status
- available
- Workarounds
- ACROS Security released unofficial 0Patch fixes for Windows 10 2004 or later and Windows Server 2022 or later.
MITRE ATT&CK
CVE
People
Kevin BeaumontPublished LegacyHive exploitation detection queries and confirmed that the exploit worked.Nightmare EclipseA security researcher using this handle disclosed LegacyHive and released a proof-of-concept exploit.Will DormannA vulnerability analyst explained how the exploit could modify the classes registry hive and enable code execution when an admin account logs in.
Vendors
Products
0PatchKevin Beaumont published detection queries, and ACROS Security released unofficial 0Patch fixes.Microsoft Defender for EndpointOne day after the PoC was released, cybersecurity expert Kevin Beaumont also published LegacyHive exploitation detection queries for Microsoft Defender for Endpoint (MDE) and confirmed that the exploit worked.Microsoft WindowsMicrosoft has released patches for the Windows zero-day vulnerability LegacyHive, now tracked as CVE-2026-62832, after it was disclosed with a proof-of-concept exploit.Windows User Profile ServiceThe flaw affects the Windows User Profile Service and can let authenticated local attackers gain administrator privileges; Microsoft and other researchers also provided detection and unofficial mitigation guidance.