Researcher Drops New Windows Zero-Day PoC Hours After Microsoft Patch Tuesday
Summary: Security researcher Chaotic Eclipse released a proof-of-concept exploit called LegacyHive, a Windows User Profile Service (ProfSvc) arbitrary hive load elevation-of-privileges vulnerability that works on all supported desktop and server versions of Windows, including those running the July 2026 Patch Tuesday update. The PoC requires a second standard user credential and a third username, and mounts a target user's UsrClass.dat hive inside a low-privileged user's registry namespace; 0patch released free micropatches on July 20, 2026, and Microsoft said it is investigating.
What's compelling: This is the ninth Windows exploit Chaotic Eclipse has released in three months without coordinated disclosure, and Cyderes' Brian Hussey describes the pattern as an operator building a toolkit rather than a researcher publishing bug reports. With no patch from Microsoft today, the exposure is a non-admin user sitting at a machine who can mount an administrator's registry hive in full access mode and modify what executes the next time that administrator logs in.
Read the original at The Hacker News ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2026-32201CVE-2026-45659CVE-2026-56155CVE-2026-56164
- Related