Microsoft patches LegacyHive Windows zero-day vulnerability

What happened

The summary is truncated, so I’ll pull the BleepingComputer report and official details first, then write the paragraphs only from those facts.The patch article is live; I’ll pull the full BleepingComputer pieces and the Microsoft advisory so names, CVEs, and dates stay accurate.Microsoft has released August 2026 Patch Tuesday security patches for the Windows zero-day known as LegacyHive and now tracks the issue as CVE-2026-62832. The flaw was disclosed after the July 2026 Patch Tuesday by a researcher using the Nightmare Eclipse handle, who published a proof-of-concept exploit hours after those July updates shipped. Nightmare Eclipse framed the drop as a protest of Microsoft's bug bounty and vulnerability disclosure practices. Microsoft says successful exploitation lets local attackers gain administrator privileges. The company has not credited Nightmare Eclipse and has instead tagged the report as coming from an anonymous researcher.

The bug sits in the Windows User Profile Service. Microsoft describes it as improper link resolution before file access, a link-following condition. An authenticated attacker who has credentials for another local account can run a specially crafted application that loads another user's registry hive. Microsoft says that can let the attacker access or modify another user's data and gain administrator privileges, and that user interaction is not required. Nightmare Eclipse said the published proof of concept requires credentials for another standard user plus a third username, which can be an administrator account, and that a successful run mounts the target user's hive under the current user's classes root. The researcher said the original proof of concept did not need extra credentials and was not limited to usrclass.dat, so any hive could be loaded. Will Dormann of Tharros tested the public exploit and showed that a non-admin user can rewrite the classes registry hive so code runs automatically the next time the admin account logs in. His demo remapped .txt files to open calc.exe.

The technical detail

That mechanic matters on any Windows machine with more than one local account. Shared workstations, jump hosts, and terminal servers already give a standard user a login session, and the User Profile Service loads hives on that path. A write to another user's classes hive is a delayed execution primitive, because COM registrations and file associations live there, so the payload fires when the higher-privilege account next signs in. The public proof of concept is not a remote worm and is not kernel remote code execution. It is a post-authentication privilege escalation that turns a second set of local credentials into a hive mount and then into admin. Engineers who treat a standard user with no UAC prompt as a hard wall should put hive load and link resolution on the profile path in the same trust boundary as the login session.

Why it matters for builders

The August fix also closes one item in a longer public fight over Windows zero-day disclosure. Since April 2026, Nightmare Eclipse has published exploits named ShieldBreak, RoguePlanet, YellowKey, BlueHammer, RedSun, GreenPlasma, MiniPlasma, and UnDefend against Microsoft Defender, BitLocker, and other Windows components. Microsoft patched YellowKey, GreenPlasma, and MiniPlasma in June 2026 and RoguePlanet in July. Other drops from the same researcher still wait for an official fix. Microsoft has defended coordinated vulnerability disclosure and earlier warned of legal action against people it said were causing real harm to customers. Crediting CVE-2026-62832 to an anonymous researcher rather than Nightmare Eclipse leaves that dispute in the advisory even as the August updates close this specific hole.

Market and competitive context

Operators should apply the August 2026 Patch Tuesday updates that cover CVE-2026-62832 and treat any still-unpatched machine with multiple local accounts as exposed. ACROS Security, the company behind the 0Patch platform, shipped free unofficial micropatches on July 20 for Windows 10 2004 or later and Windows Server 2022 or later. ACROS CEO Mitja Kolsek said the flaw lets a regular non-admin user mount another user's registry hive in full access mode and then extract stored secrets or change values that control what runs at next logon. With 0Patch enabled, the same exploit still appears to run but loads a temporary user profile hive instead of the admin user's hive, which is useless to the attacker. Kevin Beaumont confirmed the public exploit worked a day after it dropped and published Microsoft Defender for Endpoint hunting queries for it. Hunt for unexpected hive mounts and classes-root remaps on machines unpatched between the July disclosure and this week's official updates.

What to watch next

Two caveats sit on the official fix. The published proof of concept was intentionally harder to weaponize than Nightmare Eclipse's earlier drops, so the public record understates what a motivated attacker could do with the original, unrestricted hive-load path. Microsoft has still not shipped patches for every zero-day in this researcher's series, so closing LegacyHive does not close the Defender and BitLocker surfaces those other names point at. The unofficial 0Patch micropatches skip versions older than Windows 10 2004 and Windows Server 2019, which ACROS said are not affected, and they do not replace the official August updates on supported SKUs. Open questions remain whether Microsoft will revise the CVE credit, whether any still-unpatched Nightmare Eclipse issues have been used in the wild, and whether the August patch blocks hive loads beyond usrclass.dat or only the stripped public path.