LegacyHive: User Profile Service Arbitrary Hive Load Zero-Day

Summary

LegacyHive is the ninth public Windows security drop from the researcher operating as MSNightmare / Nightmare-Eclipse (also Chaotic Eclipse, Dead Eclipse). Published July 14, 2026 — hours after Microsoft’s July Patch Tuesday — it targets the Windows User Profile Service (ProfSvc), which runs at SYSTEM integrity and loads user registry hives at logon.

Unlike earlier cluster tools that shipped finished SYSTEM or BitLocker paths, LegacyHive publishes a registry hive loading primitive: the PoC coerces profile initialization into mounting an unintended UsrClass.dat into a low-privileged user’s HKU\…_Classes namespace. No memory corruption is involved — the chain abuses offline hive configuration, Object Manager path redirection, and synchronized profile load timing.

The public PoC is deliberately stripped. It requires credentials for a second standard user plus a third username (which may be an administrator). The researcher states the unreleased original needed neither, and was not limited to UsrClass.dat — claiming any hive could be loaded. Cyderes Howler Cell independently reproduced the published PoC on Windows 11 and confirmed cross-user hive redirection via a planted registry marker.

As of 2026-07-31: no CVE (NVD keyword search returns none), no MSRC Update Guide advisory naming LegacyHive / ProfSvc hive-load abuse, and no Microsoft Windows cumulative or OOB security update documented as a root-cause fix. Microsoft told SecurityWeek and BleepingComputer it is aware and investigating. ACROS Security / 0patch has published an unofficial micropatch (not a Microsoft OS update). Community Microsoft Defender for Endpoint hunting queries exist; this indexing found no Microsoft Defender Antimalware Platform / engine advisory that claims LegacyHive sample detection or ProfSvc hardening. OFFSITE.DARK indexes Project Nightcrawler and third-party analysis only; we did not discover or weaponize this flaw.

Key Findings

Cluster context

LegacyHive continues the Nightmare-Eclipse pattern: publish against Microsoft security guarantees immediately after Patch Tuesday, no coordinated disclosure, mirrors on GitHub and Project Nightcrawler.

What is the vulnerability?

Normal profile load maps each user’s hives from trusted paths under that user’s profile into that user’s HKEY_USERS namespace. LegacyHive breaks that boundary.

Cyderes describes three cooperating mechanisms:

1. Offline NTUSER.DAT modification — rewrite the authenticated user’s unloaded hive (Offline Registry Library) so Local AppData points at an attacker-controlled Object Manager path, then swap the modified hive in.
2. Object Manager symbolic link redirection — links under \BaseNamedObjects\Restricted steer the path ProfSvc trusts during load.
3. Synchronized batch oplock — pause profile I/O at the right moment so the redirected path is used before Windows continues.

Together, the User Profile Service loads a target user’s UsrClass.dat into the low-privileged user’s classes root instead of the expected hive.

Public PoC workflow (high level)

Howler Cell documents six operator-visible stages (no step-by-step weaponization here):

1. Validate second-user credentials and target username.
2. Build Object Manager namespace / symbolic links used for path redirection.
3. Authenticate / impersonate the low-privileged user; offline-edit NTUSER.DAT Local AppData.
4. Stage a copy of the target UsrClass.dat, place a batch oplock, and force a profile load via CreateProcessWithLogonW with LOGON_WITH_PROFILE (child often a common binary such as notepad.exe left CREATE_SUSPENDED).
5. On oplock fire, adjust redirection so ProfSvc mounts the target hive into the wrong user’s namespace.
6. Confirm by reading a target-only registry marker through the low-priv user’s classes root.

Impact of the public release: cross-user registry data access (application class registrations, Explorer-related keys, and related per-user hive content) — a building block for larger escalation, persistence, or security-product tampering chains, not a finished SYSTEM shell in the stripped PoC.

CVE / vendor status

Impact

• Cross-user confidentiality break on multi-user hosts: shared workstations, RDP session hosts, VDI — where user separation is the primary control.
• Registry primitive, not a finished LPE in the public tree — defenders should assume private / re-weaponized variants without credential and hive-type limits.
• Highest exposure where many profiles coexist on one machine; lowest on single-user locked-down endpoints (still relevant post-compromise with stolen local credentials).
• Cluster signal — ninth distinct surface from the same actor after Defender ×4, BitLocker ×2, CTF, Cloud Files regression; timed to maximize unpatched window after July updates.

Detection

Static hashes are weak (source-distributed PoC). Hunt behavior:

Tune on the combination (cross-SID suspended profile load + hive path anomalies), not isolated APIs. Do not confuse hunting queries or third-party EDR rules with a Microsoft OS or Defender platform root-cause fix.

Mitigation

1. No Microsoft root-cause OS patch as of 2026-07-31 — treat as active zero-day on July 2026-patched Windows desktop and server until MSRC ships and documents a fix for this class of abuse.
2. Prioritize behavioral EDR for the CreateProcessWithLogonW / suspended-benign-binary / foreign-hive mount pattern above; evaluate community MDE Advanced Hunting queries where Defender for Endpoint is deployed.
3. Reduce multi-user blast radius: separate high-value admin sessions from shared RDP/VDI pools where operationally feasible.
4. Restrict Create symbolic links and closely monitor Object Manager link creation in restricted namespaces where policy allows.
5. Alert on unexpected offline access to profile hive files (NTUSER.DAT, UsrClass.dat) by non-system processes.
6. Track MSRC / Windows Update for a future OS security update; track Defender platform notes separately — do not assume a signature update equals a ProfSvc fix.
7. Evaluate 0patch (or other unofficial micropatches) only after change-control review; they are not Microsoft cumulative updates and do not replace vendor remediation when it ships.
8. Assume cluster reuse — prior Nightmare-Eclipse tools are already in intrusion chains; correlate LegacyHive primitives with BlueHammer/RedSun/UnDefend/RoguePlanet TTPs.

Timeline

Updates

• 2026-07-14 — Original disclosure / stripped PoC published; author states PoC is functional on all currently supported desktop and server installs with July 2026 patches (GitHub MSNightmare/LegacyHive README; Project Nightcrawler mirror).
• 2026-07-14 — CrowdStrike July Patch Tuesday analysis notes LegacyHive as a separate unpatched ProfSvc privilege-escalation disclosure the same day; “no CVE has been assigned, and no patch is available” at time of writing (CrowdStrike).
• 2026-07-15 — Cyderes Howler Cell publishes technical analysis and Windows 11 reproduction; states no CVE, Microsoft advisory, or patch addresses LegacyHive (Cyderes).
• 2026-07-15 — The Register coverage of disclosure; later update quotes Microsoft as aware and investigating (The Register).
• 2026-07 — SecurityWeek publishes Microsoft spokesperson statement: aware, actively investigating validity/applicability; supports CVD (SecurityWeek).
• 2026-07-20 — LevelBlue SpiderLabs overview: works on July 2026-patched Windows desktop/server; “as of writing, Microsoft has yet to publicly acknowledge or release a patch” in that piece (LevelBlue) — note SecurityWeek/BleepingComputer later carried explicit Microsoft statements.
• 2026-07-21 — BleepingComputer: Microsoft still has no CVE / no security updates; quotes Microsoft investigating; documents free unofficial 0patch micropatches from ACROS Security for Windows 10 2004+ and Windows Server 2022+ (in-memory; no reboot claimed); also notes community MDE detection queries from Kevin Beaumont (BleepingComputer).
• Prior OFFSITE.DARK / chat history (~2026-07-14–15 publish; Nightcrawler checks ~2026-07-23 and 2026-07-31 recon) — Article text and Nightcrawler README still described LegacyHive as unpatched; no author note claiming a Microsoft fix.
• Last verified: 2026-07-31 — Re-check findings:
  • Still unpatched by Microsoft Windows OS updates (no documented cumulative / OOB / Preview fix for this ProfSvc hive-load class).
  • Still no CVE in NVD for “LegacyHive”; MSRC July 2026 CVRF has zero matches for LegacyHive / ProfSvc / UsrClass / “User Profile Service” / “registry hive.”
  • July CVRF does include unrelated CVE-2026-50425 (Internal System User Profile UAF) — not LegacyHive.
  • No August 2026 MSRC CVRF document available yet.
  • Author README on GitHub / Nightcrawler unchanged on patch claim (July 2026-patched systems still asserted vulnerable); Nightcrawler last README update remains 2026-07-14.
  • Defender: no primary-source Microsoft Antimalware Platform / engine release notes verified that advertise LegacyHive detection or ProfSvc hardening; hunting remains behavioral / community KQL.
  • 0patch: unofficial micropatch coverage remains the main documented interim code-level mitigation (per BleepingComputer / ACROS statements) — distinct from Windows Update.

Sources

• Project Nightcrawler — NightmareEclipse/LegacyHive (primary PoC source)
• GitHub — MSNightmare/LegacyHive (upstream origin mirrored by Nightcrawler)
• Cyderes Howler Cell — LegacyHive: Windows User Profile Service Arbitrary Hive Loading (reproduction + detection)
• SecurityWeek — Nightmare Eclipse Drops LegacyHive Windows Zero-Day (Microsoft investigating statement)
• BleepingComputer — Windows LegacyHive zero-day flaw gets free, unofficial patches (Microsoft statement; 0patch; MDE hunting note)
• The Register — Microsoft’s serial tormentor drops LegacyHive 0-day
• CrowdStrike — July 2026 Patch Tuesday analysis (LegacyHive note)
• LevelBlue SpiderLabs — LegacyHive stripped PoC overview
• LevelBlue SpiderLabs — Hunting profile initialization abuse
• GossiTheDog — LegacyHive MDE Advanced Hunting queries
• MSRC — July 2026 Security Updates CVRF (no LegacyHive / ProfSvc hive-load entry; CVE-2026-50425 is a distinct UAF)
• NVD CVE API (keyword search “LegacyHive” — no results as of 2026-07-31)
• OFFSITE.DARK — RoguePlanet cluster index