Windows Zero-Day PoC Exploit Released Shortly After Microsoft Patch Tuesday

Release of LegacyHive Proof-of-Concept

Chaotic Eclipse, using the alias Nightmare-Eclipse, has released a new proof-of-concept (PoC) exploit for Windows, named LegacyHive. This exploit targets a vulnerability in the Windows User Profile Service, allowing an elevation of privileges by loading various user hives.

Details of the Exploit

The PoC requires a standard user credential along with an additional username, potentially an administrator account. If exploited successfully, it allows access to the target user hive within the current user's context. The researcher noted that the PoC is a simplified version of an original exploit that did not require extra credentials.

Broader Implications of LegacyHive

LegacyHive is notable for being functional on all supported desktop and server versions of Windows, including those affected by the July 2026 Patch Tuesday security updates. This raises critical security implications, especially given the ongoing disputes between Chaotic Eclipse and Microsoft regarding timely disclosure and patching of vulnerabilities.

Microsoft's Ongoing Security Challenges

Microsoft recently addressed a record 622 vulnerabilities in its security updates, including two for SharePoint Server flagged as actively exploited. However, concerns remain as additional flaws disclosed by the researcher have led to real-world exploitation before being patched. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has listed certain vulnerabilities under its Known Exploited Vulnerabilities program, emphasizing the urgent nature of addressing these security risks.