A notorious security researcher has struck again, releasing a zero-day exploit that allows attackers to escalate privileges on Windows systems. Nightmare Eclipse, also known as Chaotic Eclipse, has dropped yet another unpatched vulnerability in Microsoft’s products, this time targeting the Windows User Profile Service.
The fresh exploit, dubbed LegacyHive, enables an attacker to load other users’ hives, including those of administrators, by taking advantage of a local privilege escalation bug. The researcher released proof-of-concept (PoC) code that demonstrates how to exploit the vulnerability, which works on systems running Microsoft’s July 2026 patches.
According to Nightmare Eclipse, the PoC requires an attacker to possess standard user credentials and another username – potentially an administrator account. If successful, it will mount the target user hive in the current user class root. Notably, the exploit originally did not require user credentials to load any hive, but this would have required additional work.
What’s more concerning is that LegacyHive was released with a stripped PoC code, which prevents the vulnerability from being exploited in the wild by limiting its functionality. This means that an attacker would need to put in extra effort to fully exploit the bug.
This is not Nightmare Eclipse’s first rodeo – they have released over half a dozen zero-day exploits targeting Microsoft products since their debut. Some of these have been exploited in real-world attacks, including BlueHammer, RedSun, and UnDefend. GreenPlasma, RoguePlanet, YellowKey, and GreatXML are also part of the researcher’s impressive list.
Microsoft has yet to acknowledge the LegacyHive exploit or provide any statement on the matter. As the vulnerability is still unpatched, it poses a significant risk to users running Windows systems with outdated patches. SecurityWeek has reached out to Microsoft for comment, but so far, no response has been received.
The release of this zero-day exploit serves as a stark reminder of the ongoing cat-and-mouse game between security researchers and attackers. As vulnerabilities like LegacyHive continue to emerge, it’s essential for users to stay vigilant and keep their systems up-to-date with the latest patches.
If you’re running Windows and haven’t applied the July 2026 patches yet, consider doing so as soon as possible. Additionally, be cautious when using user accounts that have administrative privileges – attackers can exploit vulnerabilities like LegacyHive to gain elevated access to these accounts, putting your entire system at risk. By taking proactive steps to secure your systems, you’ll significantly reduce the likelihood of falling victim to a potential attack exploiting this vulnerability.
Source: SecurityWeek — 2026-07-16