NewsBite analysis · Programming, Security
BleepingComputer
New Windows LegacyHive zero-day gives hackers admin privileges
The LegacyHive zero-day exploit, recently disclosed by a researcher, enables privilege escalation on Windows systems. By abusing a flaw within the User Profile Service, it allows non-admin users to modify registry settings, potentially leading to unauthorized code execution. This vulnerability has not yet been assigned a CVE ID and raises significant security concerns. Microsoft has been informed and is faced with the challenge of mitigating the risks associated with this exploit while also addressing the legal considerations surrounding the researcher’s disclosures.
Act nowConfidence: HighImmediate horizonCybersecurity risk: High
Published 17 Jul 2026, 12:50 UTC2 min read
Visit original article ↗Lead image — BleepingComputer
Summary
TL;DR
- LegacyHive exploit enables privilege escalation on Windows systems.
- Requires additional user credentials for exploitation.
- Modifies registry settings leading to potential code execution.
- No CVE ID assigned yet for tracking.
- Microsoft warns of legal actions concerning exploit disclosures.
Interesting facts
- The researcher aims to restrict public exploitation by modifying the original PoC.
- Successful exploitation can allow non-admin users to execute code upon admin login.
- Other recent disclosures from the researcher include numerous Windows vulnerabilities.