Windows zero-day exploit released as Microsoft issues record patch cycle

On 15 July 2026, an anonymous security researcher operating under the handle NightmareEclypse published proof-of-concept exploit code for HiveLegacy, a zero-day vulnerability affecting the Windows User Profile Service. The release coincided with Microsoft issuing a record number of security patches, marking a significant moment in the company’s ongoing efforts to address software vulnerabilities. Microsoft confirmed it is aware of the report and is currently investigating the issue, while urging researchers to adhere to coordinated disclosure policies.

HiveLegacy is described as a powerful primitive that allows low-privilege user accounts to modify administrator registry hives, specifically the classes registry hive. This resource ensures the correct application opens when certain file types are clicked in Windows Explorer. By exploiting the mechanism through which Windows loads user class hives in the context of NT AUTHORITY\SYSTEM when a new user logs on, attackers can potentially gain de facto administrator privileges. The exploit requires the attacker to know the credentials of one user and the username of a third account on the target machine.

Will Dormann, a senior principal vulnerability analyst at Tharros Labs, highlighted the severity of the threat. He noted that the ability to modify the classes registry hive of an admin user is a significant risk, potentially allowing attackers to run code when an administrator logs in. Dormann suggested the exploit could possibly be chained with other vulnerabilities to gain direct administrative access, noting that clever attackers could figure out how to accomplish more complex tasks without requiring user interaction.

The researcher, who has previously published nine similar exploits citing complaints about Microsoft’s handling of bug reports, stated that the proof-of-concept code has been stripped down to prevent malicious misuse. Independent researcher Kevin Beaumont has published a detection script to help protect systems against the vulnerability. Additional defensive measures recommended include restricting local non-user account creation, monitoring ProfSvc for unexpected hive loads, and tracking NTUSER.DAT/UsrClass.dat activity.

Microsoft’s statement on the matter reiterated its preference for coordinated disclosure policies. The simultaneous release of the exploit and a record number of patches underscores the challenges faced by the software giant in maintaining security across its vast ecosystem. As investigations continue, IT administrators are advised to implement the suggested monitoring and restriction measures to mitigate the risk posed by HiveLegacy.