> ## Content Index
> Fetch the complete content index at: https://www.russianhackers.co/llms.txt
> Use this file to discover other available public pages before exploring further.

# LegacyHive: Unpatched Windows Zero-Day PoC Dropped Hours After Patch Tuesday
- URL: https://www.russianhackers.co/legacyhive-unpatched-windows-0day-poc-after-patch-tuesday/
- Published: 2026-07-16T21:25:12.000Z
- Updated: 2026-07-16T21:25:12.000Z
- Author: Martin
- Tags: 0/1 day, Hackers

Within hours of July's Patch Tuesday, a researcher going by Nightmare Eclipse (also seen as Chaotic Eclipse) published a proof-of-concept exploit for a new Windows vulnerability dubbed LegacyHive. No patch existed at the time of release, and the exploit works on the latest build of the system, assembled with July's updates already applied.

The vulnerability lives in the Windows User Profile Service (ProfSvc) and its registry hive loading mechanism. When a user signs in, Windows mounts the UsrClass.dat file in the SYSTEM context. LegacyHive lets an attacker mount another user's hive under their own Classes registry branch, and from there read and modify that account's COM settings and file associations. In practice it is a post-exploitation tool: by swapping the right entries, an attacker gets their own code to run with the victim's privileges on that victim's next login, up to and including an administrator.

The exploit needs local access and a standard user account. Unlike the original, the released version additionally requires credentials for a second standard user and the name of a third account, which can be an administrator. All supported Windows versions are affected, both desktop and server.

Microsoft said it is aware of the report and is investigating the validity and applicability of the claims. There is still no patch. LegacyHive is the ninth zero-day Nightmare Eclipse has published amid a long-running dispute with the company: the researcher claims the Microsoft Security Response Center (MSRC) ignored the reports, blocked accounts, and deleted exploit repositories. Microsoft, for its part, criticizes the release of exploits before fixes are available.

With no patch yet, a KQL threat-hunting query published by researcher Kevin Beaumont helps detect exploitation attempts.

*Based on reporting by The Hacker News.*