Windows 'LegacyHive' zero-day hands ordinary users admin power on fully patched PCs
A researcher published working attack code hours after Microsoft's July 2026 patches, and it still works. Microsoft has no fix yet, and no CVE has been assigned.
Key points
- A researcher using the handle Nightmare Eclipse published a working Windows zero-day exploit called LegacyHive in July 2026, hours after Microsoft's monthly patches.
- The flaw sits in the Windows User Profile Service and lets a standard user gain administrator control when an admin later logs in.
- Microsoft hasn't issued a patch or a CVE tracking number for the bug.
- Will Dormann of Tharros confirmed the exploit works on up-to-date Windows systems.
- Kevin Beaumont has published detection rules for Microsoft Defender for Endpoint so defenders can spot the attack.
A security researcher who goes by Nightmare Eclipse has released working attack code for a fresh Windows flaw, calling it LegacyHive. It lets a normal user on a Windows PC quietly promote themselves to administrator, meaning full control of the machine.
The code appeared hours after Microsoft's July 2026 Patch Tuesday, the monthly bundle of security fixes Microsoft ships on the second Tuesday of every month. The bug it targets wasn't in that bundle, and there's no fix yet.
No CVE number exists for it either. A CVE is the standard ID (in the form CVE-YYYY-NNNNN) the industry uses to track a specific software flaw. Without one, defenders have to describe the bug the long way round. We first reported on LegacyHive on 15 July 2026, when the proof-of-concept had just dropped.
How does the attack actually work?
The flaw lives in the Windows User Profile Service, which sets up your desktop and settings when you sign in. Nightmare Eclipse found a way to abuse it so a non-admin can tamper with part of the Windows registry (the internal settings database) belonging to another user, including an administrator.
Once that tampering is in place, the attacker waits. The next time an administrator logs into the same machine, code chosen by the attacker runs automatically, with admin rights.
Will Dormann, principal vulnerability analyst at Tharros, tested the public code and confirmed it works. As a harmless demonstration, he made Windows open the calculator app whenever anyone double-clicked a text file. Swap the calculator for malware and the joke stops being funny.
Is this as bad as it sounds?
Mostly, but with one caveat. Nightmare Eclipse deliberately weakened the public code before releasing it. The downloadable version needs a second set of standard user credentials and a third username to work, which is an unusual hurdle.
In the researcher's own words, the original version needed none of that and could load "any hive" (any chunk of the registry), not just the user's. So the bug itself is more powerful than the proof of concept suggests, and a skilled attacker could likely rebuild the stronger version.
Multi-factor authentication won't help here. This isn't a login attack. The attacker already has a working account on the machine and is climbing from standard user to admin, a permissions problem rather than an identity one.
What can defenders do right now?
One day after the code dropped, Kevin Beaumont published detection queries for Microsoft Defender for Endpoint, Microsoft's enterprise security product. Organisations running it can paste those queries in and start hunting.
Admins should also avoid logging into shared workstations with a privileged account until Microsoft ships a fix. If an admin never logs in, the trap never springs.
Should you worry about more bugs like this?
Nightmare Eclipse has been prolific. Since Threat Vectr first covered this researcher on 9 June 2026, we've reported on six separate disclosures. The earlier targets included Windows Defender, BitLocker and other components, under names like RoguePlanet, BlueHammer, RedSun, YellowKey, GreenPlasma, MiniPlasma and UnDefend. Microsoft patched GreenPlasma, MiniPlasma and YellowKey in the June 2026 update and RoguePlanet in July.
As BleepingComputer noted, Microsoft has responded with public warnings about legal action against those causing "real harm to our customers." Several researchers read that as aimed squarely at Nightmare Eclipse. Microsoft didn't comment in time for publication.
Until a patch arrives, treat any shared Windows machine where non-admins can log in as a loaded trap, waiting for the next administrator to walk in.
