[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f9e-iwFiSD7uACaDq0SMWA08-jbgwa6KHEYXJ8PNz-ec":3},{"article":4,"iocs":41,"watch_terms":59,"solutions":60,"lesson":154},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":30,"category":31,"article_tags":35},"f0fb3808-7101-4daa-9b8b-f0587d27a532","New Windows LegacyHive zero-day gives hackers admin privileges","new-windows-legacyhive-zero-day-gives-hackers-admin-privileges-3ad33d","A security researcher using the \"Nightmare Eclipse\" handle has released a Windows zero-day exploit dubbed LegacyHive that allows attackers to escalate privileges on up-to-date Windows systems. [...]","Security researcher Nightmare Eclipse has released a proof-of-concept exploit for LegacyHive, a Windows zero-day vulnerability in the User Profile Service that allows privilege escalation on fully patched systems. The exploit abuses the Windows registry hive loading mechanism to grant attackers admin-level code execution when an administrator logs in. Microsoft has not yet assigned a CVE ID to the vulnerability and has threatened legal action against the researcher.","Nightmare Eclipse releases LegacyHive Windows zero-day enabling privilege escalation to admin.","https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fnew-windows-legacyhive-zero-day-exploit-grants-hackers-admin-access\u002F","https:\u002F\u002Fwww.bleepstatic.com\u002Fcontent\u002Fhl-images\u002F2026\u002F02\u002F13\u002FWindows-headpic.jpg","2026-07-17T11:05:30+00:00","2026-07-17T12:00:21.096092+00:00",9,[17,20,23,26,28],{"name":18,"type":19},"Nightmare Eclipse","threat_actor",{"name":21,"type":22},"Microsoft","vendor",{"name":24,"type":25},"Windows User Profile Service","product",{"name":27,"type":25},"Microsoft Defender for Endpoint",{"name":29,"type":25},"BitLocker","574f766a-fb3f-487c-8d2c-0720ae75471b",{"id":30,"icon":32,"name":33,"slug":34},null,"Zero-day","zero-day",[36],{"category":37},{"id":38,"icon":32,"name":39,"slug":40},"80544778-fabb-4dcd-aa35-17492e5dcf4f","Vulnerabilities","vulnerabilities",[42,46,49,52,55,57],{"type":43,"value":44,"context":45},"malware","LegacyHive","Windows privilege escalation exploit targeting User Profile Service",{"type":43,"value":47,"context":48},"RoguePlanet","Windows Defender zero-day vulnerability patched July 2026",{"type":43,"value":50,"context":51},"BlueHammer","Windows zero-day exploit previously disclosed by Nightmare Eclipse",{"type":43,"value":53,"context":54},"GreenPlasma","Windows vulnerability patched June 2026",{"type":43,"value":56,"context":54},"YellowKey",{"type":43,"value":58,"context":54},"MiniPlasma",[21,24,27],{"controls":61,"vendors":148},[62,90,119],{"slug":63,"name":64,"problem":65,"products":66},"privileged-access-management","Privileged access management (PAM)","Admin accounts stop being one stolen password away from control of everything.",[67,75,83],{"vendor_slug":68,"vendor_name":69,"vendor_logo":70,"product_slug":71,"product_name":72,"url":73,"description":74},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","idira-privileged-access-management","Idira Privileged Access Management","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fidira\u002Fhuman\u002Fprivileged-access-management","Privileged access management from the former CyberArk portfolio: vaulting, rotation, just-in-time access and session monitoring.",{"vendor_slug":76,"vendor_name":77,"vendor_logo":78,"product_slug":79,"product_name":80,"url":81,"description":82},"wallix","WALLIX","\u002Fvendor-logos\u002Fwallix.png","wallix-pam","WALLIX PAM","https:\u002F\u002Fwww.wallix.com\u002Fproducts\u002Fprivileged-access-management-software\u002F","Privileged access management with session recording, for IT and OT environments.",{"vendor_slug":84,"vendor_name":85,"vendor_logo":86,"product_slug":63,"product_name":87,"url":88,"description":89},"threatlocker","ThreatLocker","\u002Fvendor-logos\u002Fthreatlocker.png","Privileged Access Management","https:\u002F\u002Fwww.threatlocker.com\u002Fcapabilities\u002Fprivileged-access-management","Gives elevated rights to specific applications only where needed, so users do not need local admin accounts.",{"slug":91,"name":92,"problem":93,"products":94},"patch-management","Automated patch management","Known holes get closed in days, not months.",[95,103,111],{"vendor_slug":96,"vendor_name":97,"vendor_logo":98,"product_slug":99,"product_name":100,"url":101,"description":102},"ivanti","Ivanti","\u002Fvendor-logos\u002Fivanti.png","neurons-patch-management","Ivanti Neurons for Patch Management","https:\u002F\u002Fwww.ivanti.com\u002Fproducts\u002Fivanti-neurons-for-patch-management","Risk-based patch management for operating systems and third-party applications.",{"vendor_slug":104,"vendor_name":105,"vendor_logo":106,"product_slug":107,"product_name":108,"url":109,"description":110},"action1","Action1","\u002Fvendor-logos\u002Faction1.png","action1-patch-management","Action1 Patch Management","https:\u002F\u002Fwww.action1.com\u002F","Cloud-native patch management for Windows, macOS and third-party applications.",{"vendor_slug":112,"vendor_name":113,"vendor_logo":114,"product_slug":115,"product_name":116,"url":117,"description":118},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"slug":120,"name":121,"problem":122,"products":123},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[124,132,140],{"vendor_slug":125,"vendor_name":126,"vendor_logo":127,"product_slug":128,"product_name":129,"url":130,"description":131},"sentinelone","SentinelOne","\u002Fvendor-logos\u002Fsentinelone.png","singularity-endpoint","Singularity Endpoint","https:\u002F\u002Fwww.sentinelone.com\u002Fplatform\u002Fendpoint-security\u002F","Endpoint protection and detection with automated response and rollback.",{"vendor_slug":133,"vendor_name":134,"vendor_logo":135,"product_slug":136,"product_name":137,"url":138,"description":139},"sophos","Sophos","\u002Fvendor-logos\u002Fsophos.png","sophos-endpoint","Sophos Endpoint","https:\u002F\u002Fwww.sophos.com\u002Fen-us\u002Fproducts\u002Fendpoint-security","Endpoint protection with Intercept X anti-ransomware technology and EDR.",{"vendor_slug":141,"vendor_name":142,"vendor_logo":143,"product_slug":144,"product_name":145,"url":146,"description":147},"withsecure","WithSecure","\u002Fvendor-logos\u002Fwithsecure.png","elements-xdr","WithSecure Elements XDR","https:\u002F\u002Fwww.withsecure.com\u002Fen\u002Ffor-business\u002Fplatform\u002Fxdr\u002F","Endpoint detection and response with extended detection, on the Elements cloud platform.",[149],{"slug":150,"name":21,"logo_path":151,"roles":152},"microsoft","\u002Fvendor-logos\u002Fmicrosoft.png",[153],"affected",{"slug":155,"title":156,"body":157,"framework_refs":158,"framework_notes":169},"windows-legacyhive-zero-day-enables-privilege-escalation-on-fully-patched-systems","Windows LegacyHive Zero-Day Enables Privilege Escalation on Fully Patched Systems","A publicly disclosed zero-day vulnerability in Windows' User Profile Service allows attackers to abuse the registry hive loading mechanism to gain administrator-level code execution — even on fully patched systems. The absence of an assigned CVE and Microsoft's legal response to the researcher highlights a breakdown in coordinated disclosure, leaving defenders without an official patch or mitigation guidance. This is particularly dangerous because the exploit is triggered when an administrator logs in, making it an attractive target for attackers who already have limited footholds on a system. Organizations cannot rely solely on patch management here; compensating controls must be deployed immediately to reduce exposure until an official fix is released.",[159,160,161,162,163,164,165,166,167,168],"CIS Control 5 - Account Management","CIS Control 7 - Continuous Vulnerability Management","CIS Control 8 - Audit Log Management","NIST SP 800-53 AC-6 - Least Privilege","NIST SP 800-53 SI-2 - Flaw Remediation","NIST SP 800-53 AU-12 - Audit Record Generation","NIST SP 800-40 - Guide to Enterprise Patch Management","MITRE ATT&CK T1547 - Boot or Logon Autostart Execution","MITRE ATT&CK T1134 - Access Token Manipulation","ISO\u002FIEC 27001 A.12.6 - Technical Vulnerability Management",{}]