A researcher going by "Nightmare Eclipse" published proof-of-concept code for a new Windows flaw called LegacyHive just hours after Microsoft's July 2026 Patch Tuesday — meaning it hit machines that had just installed everything Microsoft shipped that day. It's the same researcher's sixth uncoordinated disclosure since April, following bugs nicknamed BlueHammer, RedSun, and UnDefend, each dropped publicly with no advance notice to Microsoft.
The flaw sits in the Windows User Profile Service, the background component that loads a user's registry hive — their personal slice of settings, cached credentials, and configuration — when they log in. By combining registry poisoning, an object-manager symbolic link, and a timing race against the service's file locks, a standard, non-admin account can trick that SYSTEM-level service into loading a different user's hive under its own profile, including an administrator's. Once it has that hive, the attacker can read out whatever secrets were stored there, or quietly plant a value that runs code automatically the next time the real admin logs in. It affects every currently supported build of Windows 10, Windows 11, and Windows Server 2016, 2019, and 2022.
As of writing, Microsoft has not assigned a CVE number, published an advisory, or shipped a fix. ACROS Security's 0patch service has released a free unofficial micropatch that closes the gap by redirecting the exploit to a decoy profile instead of the real target — it applies without a reboot and is meant as a stopgap until Microsoft ships something official.
What this means for your business
- This isn't a missed update — there's nothing to update yet. Every supported Windows 10, 11, and Server machine is exposed regardless of patch level, because Microsoft hasn't shipped a fix to apply.
- It needs a foothold first. The attacker has to already be running as some standard user on the machine — via a phishing click, a compromised employee login, or a shared workstation. That's still a very ordinary way for an attacker to get in; this bug is what turns that ordinary foothold into full admin-level access.
- The free micropatch is worth applying now, especially on shared machines, front-desk PCs, or any device where more than one person logs in with their own account. It's low-risk and reversible once Microsoft's own fix arrives.
- Ask whoever manages your Windows machines — an internal IT person or an outside provider — whether they're already tracking LegacyHive and applying the interim fix across your devices, not just the ones someone happens to remember.
None of this requires panic; it requires one conversation this week with whoever looks after your Windows machines about whether the stopgap is in place.