New Windows LegacyHive zero-day gives hackers admin privileges
Nightmare Eclipse releases LegacyHive Windows zero-day enabling privilege escalation to admin.
Security researcher Nightmare Eclipse has released a proof-of-concept exploit for LegacyHive, a Windows zero-day vulnerability in the User Profile Service that allows privilege escalation on fully patched systems. The exploit abuses the Windows registry hive loading mechanism to grant attackers admin-level code execution when an administrator logs in. Microsoft has not yet assigned a CVE ID to the vulnerability and has threatened legal action against the researcher.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Microsoft?
Get an email when a new story names Microsoft, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonA publicly disclosed zero-day vulnerability in Windows' User Profile Service allows attackers to abuse the registry hive loading mechanism to gain administrator-level code execution — even on fully patched systems. The absence of an assigned CVE and Microsoft's legal response to the researcher highlights a breakdown in coordinated disclosure, leaving defenders without an official patch or mitigation guidance. This is particularly dangerous because the exploit is triggered when an administrator logs in, making it an attractive target for attackers who already have limited footholds on a system. Organizations cannot rely solely on patch management here; compensating controls must be deployed immediately to reduce exposure until an official fix is released.
What helps against this
How we list vendors
- Privileged access management (PAM)
Admin accounts stop being one stolen password away from control of everything.
- Automated patch management
Known holes get closed in days, not months.
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- malware — LegacyHive
- malware — RoguePlanet
- malware — BlueHammer
- malware — GreenPlasma
- malware — YellowKey
- malware — MiniPlasma