NewsBite analysis · Programming, Security · Security Vulnerability
BleepingComputer
Microsoft patches LegacyHive Windows zero-day vulnerability
Microsoft has addressed a critical zero-day vulnerability called LegacyHive in its recent security updates. Discovered by the researcher Nightmare Eclipse, it targets the Windows User Profile Service and allows local attackers to modify registry hives. The exploit necessitates additional credentials, posing a challenge for threat actors. Microsoft has provided a patch as part of the August updates but has yet to credit the discoverer.
Act nowConfidence: HighImmediate horizonCybersecurity risk: High
Published 13 Aug 2026, 18:50 UTC2 min read
Visit original article ↗Lead image — BleepingComputer
Summary
TL;DR
- LegacyHive vulnerability allows local attackers to gain administrator privileges.
- Requires additional credentials, making exploitation harder.
- Microsoft patched the flaw in its August Patch Tuesday updates.
- Disclosed by researcher Nightmare Eclipse, who criticized Microsoft's bounty practices.
- ACROS Security released unofficial patches for affected systems.
Interesting facts
- The vulnerability stems from improper link resolution before file access.
- The discoverer has released multiple zero-day exploits since April 2026.
- The exploit requires no user interaction for successful exploitation.