Nightmare Eclipse Releases 'LegacyHive' Windows Zero-Day on Patch Tuesday
A prolific anonymous researcher drops another unpatched Windows flaw, this time one that lets ordinary users quietly read administrator account data.
Key points
- Nightmare Eclipse published the LegacyHive exploit on 8 July 2026, the same day Microsoft released its scheduled monthly security fixes.
- LegacyHive is an unpatched flaw in the Windows User Profile Service that lets a standard user load and access another user's account data, including an administrator's.
- The published proof-of-concept code is deliberately stripped down to limit opportunistic criminal use.
- Nightmare Eclipse has released over half a dozen unpatched Windows flaws; BlueHammer, RedSun, UnDefend and at least one other have been used in real attacks.
- Microsoft had not publicly acknowledged LegacyHive at the time of publication, as first reported by SecurityWeek.
A researcher going by Nightmare Eclipse, also known as Chaotic Eclipse, published a new unpatched Windows security flaw on 8 July 2026, the same day Microsoft issued its regular monthly batch of security fixes, known as Patch Tuesday.
Called LegacyHive, the vulnerability sits inside the Windows User Profile Service, which manages personal settings and data for each person who logs into a machine. A "hive" is a bundle of that stored data. The bug is a local privilege escalation vulnerability: someone who already has basic access to a machine can use it to read the account data of other users, including administrators with full system control.
How dangerous is this, really?
A criminal who'd already found a foothold on your work computer at a low level could use LegacyHive to grab administrator credentials and take over completely. That's a serious step up. Nightmare Eclipse did publish a stripped-down proof-of-concept, one that demonstrates the flaw but leaves out the pieces needed for a clean attack. The PoC requires standard user credentials and a third username (which can be an administrator account); if successful, it mounts the target user's hive under the current user's classes root, the researcher explained to SecurityWeek. The original version required no credentials at all and could load any hive, not just the usrclass.dat hive. That's still possible, the researcher says, but would take additional work.
This isn't Nightmare Eclipse's first move like this. We've tracked the researcher across six stories since 9 June 2026, and the pattern holds: release on Patch Tuesday, partial code, pressure on Microsoft. BlueHammer, RedSun and UnDefend were picked up in real attacks before any patch arrived. GreenPlasma, RoguePlanet, YellowKey and GreatXML remain unpatched.
Microsoft hasn't commented on LegacyHive.
Should you worry?
The stripped PoC buys some time, but not much for anyone running exposed Windows systems. The practical priority is applying the July 2026 patches even though they don't fix LegacyHive: they close other known holes that attackers routinely chain with flaws like this one. Worth watching is whether Microsoft acknowledges the bug before someone rebuilds the full exploit. Given the track record here, that window tends to close faster than the vendor acts.
