Windows LegacyHive Zero-Day Gets a Fix, Just Not From Microsoft

A Windows zero-day that Microsoft has not fixed now has a patch anyway. ACROS Security's 0patch service shipped free micropatches this morning for LegacyHive, the Windows User Profile Service privilege-escalation flaw whose working exploit code went public on July 14, hours after Microsoft's own July Patch Tuesday updates landed. The bug still has no CVE identifier and no official fix, which means the only thing standing between a standard user account and an administrator's registry on a fully updated Windows machine is a third-party patch written by a company in Slovenia.

• The flaw: LegacyHive lets a non-admin user mount another user's registry hive with full access, including an administrator's, through the Windows User Profile Service.
• The gap: the proof-of-concept was published on July 14 and works on machines that took the July 2026 cumulative updates. Microsoft says it is "actively investigating the validity" and has not shipped a fix.
• The stopgap: 0patch's micropatches are free for everyone, apply in memory, and need no reboot. Coverage starts at Windows 10 v2004 and Windows Server 2022.
• The precondition that saves most home users: the exploit needs a second local account's credentials, which makes this a shared-workstation and terminal-server problem far more than a single-user laptop problem.

What exactly did 0patch ship?

0patch is the micropatching platform run by ACROS Security. Instead of shipping a replacement binary, it injects small instruction-level changes into processes already running in memory, so a patch applies without a reboot and reverses just as cleanly. That model exists precisely for situations like this one: a vulnerability with public exploit code and no vendor fix.

RelatedMicrosoft Patches RoguePlanet Defender Zero-Day

The LegacyHive micropatch does not try to rewrite the User Profile Service's permission logic. It changes what the service hands back. ACROS chief executive Mitja Kolsek described the approach as loading a temporary user profile hive in place of the requested one, so the attacker's mount succeeds mechanically but resolves to nothing useful. The target's real hive is never exposed, and normal profile loading for legitimate logons keeps working.

Kolsek laid out the stakes bluntly: "The vulnerability allows a regular non-admin user to mount any other user's registry hive in full access mode, and then either extract that user's stored secrets or modify any values in their registry to affect what gets executed the next time they log in."

The micropatches are free for all users, not gated behind 0patch's paid tiers. That is the company's standing practice for zero-days with no official patch, and it is the reason 0patch's releases keep making news: the fix is free, the vendor's is absent.

How does LegacyHive actually work?

The Windows User Profile Service, ProfSvc, is the component responsible for loading a user's registry hive when they log on. Each user profile carries a usrclass.dat file, the per-user classes hive that holds file associations, COM registrations and shell state. LegacyHive abuses the service's willingness to load an arbitrary hive on request, mounting a different user's usrclass.dat under the attacker's own classes root with full read and write access.

From there the escalation is not exotic. Read access alone exposes whatever secrets that user's registry holds. Write access is worse: COM registrations and shell entries under the classes hive determine what code gets loaded when that user's session starts. Plant a pointer to your own binary, wait for the administrator to log in, and your code runs with their token. It is a patient attack rather than an instant one, which is exactly why it suits an attacker who already has a foothold and is waiting for an admin to touch the box.

The researcher, who publishes as Nightmare Eclipse and has dropped Windows privilege-escalation bugs before, deliberately released a stripped proof-of-concept. The public version is limited to usrclass.dat, while the original could load any hive. The exploit also requires a second set of credentials, meaning the attacker needs one more standard local account to work with. Neither limit makes the bug theoretical. It makes it a second-stage tool.

Why has Microsoft not patched it?

Timing is most of the answer. The PoC landed on Patch Tuesday itself, hours after the July 2026 updates shipped, which is the single worst moment in the month to report a Windows bug if you want a fast turnaround. The next scheduled Patch Tuesday is in August. Microsoft could ship an out-of-band update, but it reserves those for flaws under active mass exploitation, and there is no public evidence of that here.

Microsoft's statement is the standard holding line: "Microsoft is aware of the reported vulnerability and is actively investigating the validity and potential applicability of these claims. Microsoft is committed to investigating security issues and updating impacted products to protect customers as soon as possible."

The absence of a CVE identifier matters more than it looks. Without one, the flaw does not flow through the normal plumbing: vulnerability scanners have nothing to key on, CISA has no identifier to add to its Known Exploited Vulnerabilities catalog, and compliance frameworks that track CVE remediation simply do not see it. A bug with public exploit code and no CVE is invisible to most of the tooling enterprises use to decide what to fix.

RelatedCitrix NetScaler Flaw Echoes CitrixBleed, Exploit Is Out

1. Jul 14Microsoft ships its July 2026 Patch Tuesday updates Routine monthly cycle
2. Jul 14Nightmare Eclipse publishes the LegacyHive proof-of-concept Hours after the updates land, works on patched machines
3. Jul 15Microsoft acknowledges the report and says it is investigating No CVE assigned, no fix committed
4. Jul 210patch releases free micropatches for all affected versions Seven days after public exploit code
5. Aug 11Next scheduled Patch Tuesday The earliest routine window for an official fix

Who is actually at risk?

The credential precondition is the whole risk calculation. A single-user home laptop with one account is a poor target, because the attacker needs a second account's credentials to begin. The systems that matter are the ones where multiple users share a machine and an administrator eventually logs on to the same box.

That describes a specific and unglamorous slice of infrastructure: Remote Desktop Session Hosts, Citrix and terminal-server farms, shared lab and kiosk machines, university and library workstations, and jump boxes where support staff authenticate. It also describes any environment where an initial-access broker has already sold a standard-user foothold, which is the normal starting position for ransomware crews. LegacyHive is not the way in. It is the step after the way in.

What should you do today?

If you run shared Windows workstations or session hosts, the practical answer is to install the 0patch agent on those specific machines and let the free micropatch apply. Coverage begins at Windows 10 v2004 and Windows Server 2022, so check 0patch's published list against your exact builds before assuming an older server is protected. The patch applies without a restart, which is the entire point on a session host you cannot reboot during business hours.

If a third-party agent is not acceptable in your environment, the mitigations are behavioural rather than technical. Stop creating spare local standard-user accounts on shared machines, since the exploit needs one. Keep administrators off multi-user boxes wherever a management tool can do the job remotely instead. Watch the User Profile Service for hive loads that do not correspond to a real logon, and alert on unexpected subkeys appearing under a user's classes root. None of that closes the hole, but all of it raises the cost of using it quietly.

Our take

The uncomfortable detail in this story is not the bug. Local privilege escalations in Windows are routine, and this one has a real precondition that limits it. What stands out is that a seven-person security firm shipped a working fix for an unpatched Windows flaw in seven days while the vendor was still validating the report, and did it for free.

That has become a pattern rather than an exception. 0patch has built an entire business on the space between public exploit code and Patch Tuesday, and every time it fills that space it demonstrates the gap is real, measurable and routinely a month wide. For defenders the lesson is not that Microsoft is slow. It is that a monthly patch cadence and a same-day disclosure model do not fit together, and the window between them is now a product category.

Original analysis by GenZTech. Reporting on the micropatch release via BleepingComputer.