Microsoft patches LegacyHive Windows zero-day vulnerability

Microsoft has released security updates for the LegacyHive vulnerability, a Windows zero-day flaw that could allow a local attacker to gain administrator privileges.

Tracked as CVE-2026-62832, the issue affects the Windows User Profile Service. Microsoft fixed it in the August 2026 Patch Tuesday updates after a public proof-of-concept exploit appeared shortly after July’s patches.

LegacyHive flaw can lead to admin access

The LegacyHive vulnerability stems from improper link resolution before file access in the Windows User Profile Service.

Microsoft said an authenticated attacker with credentials for another local account could run a specially crafted application to load that user’s registry hive. The attacker could then access or modify another user’s data and gain administrator privileges.

The attack does not require user interaction. However, the public proof of concept requires additional credentials, making exploitation more difficult than some earlier Windows zero-day flaws.

Security researcher Nightmare Eclipse released the LegacyHive proof of concept hours after Microsoft’s July Patch Tuesday updates. The researcher said the exploit targeted a weakness in the Windows User Profile Service.

Vulnerability analyst Will Dormann later explained that a non-administrator could modify the classes registry hive and trigger automatic code execution when an administrator logs in to the affected device.

Microsoft issues CVE-2026-62832 patch

Microsoft now tracks the issue as CVE-2026-62832 and included a fix in its August Patch Tuesday release.

The company classified the vulnerability as a local elevation-of-privilege flaw. It has not publicly credited Nightmare Eclipse for the discovery, instead listing the report as coming from an anonymous researcher.

Before Microsoft released its official update, 0Patch offered free temporary micropatches for affected systems. Those patches covered Windows 10 version 2004 and later, as well as Windows Server 2022 and later.

Organisations that used temporary protections should still install Microsoft’s official security updates as soon as possible.

Researcher has disclosed several Windows zero-days

Nightmare Eclipse has published several Windows proof-of-concept exploits since April 2026. The disclosures have targeted Microsoft Defender, BitLocker and other Windows components.

Microsoft previously patched the YellowKey, GreenPlasma and MiniPlasma flaws during June Patch Tuesday. It addressed the RoguePlanet vulnerability in July.

Other reported flaws, including ShieldBreak, BlueHammer, RedSun and UnDefend, remain without an official patch.

The string of disclosures has increased pressure on administrators to apply monthly Windows updates promptly and monitor systems for unusual local privilege-escalation activity.

Update Windows systems promptly

Administrators should deploy the August security updates across supported Windows endpoints and servers. They should also review devices where untrusted or low-privileged users may have local access.

The LegacyHive vulnerability is not a remote attack. Still, attackers often use local privilege-escalation flaws after gaining an initial foothold through phishing, malware or compromised credentials.

Prompt patching can prevent a limited user account from becoming a full administrator account, reducing the risk of broader compromise across an organisation.