LegacyHive (also referred to as MSNightmare) is a newly disclosed Windows zero-day local privilege escalation vulnerability that targets the Windows User Profile Service (ProfSvc). The flaw abuses how ProfSvc loads user registry hives, allowing a low-privileged attacker to mount another user's UsrClass.dat registry hive into their own session. A public proof-of-concept (PoC) released by the MSNightmare GitHub account demonstrates how a standard user can access an administrator's Classes registry hive, creating a pathway to modify application associations, COM objects, and shell extensions. While the publicly available PoC requires credentials for another standard user and is limited to the Classes hive, the researcher claims the original exploit is significantly more powerful and can load arbitrary registry hives without requiring additional user credentials.

The vulnerability enables attackers to tamper with administrator-specific registry settings, effectively hijacking how applications and COM components execute under the administrator's account. By modifying file associations or replacing COM registrations, attackers can achieve persistent code execution with administrator privileges the next time the targeted administrator signs in. Because the malicious code executes within the legitimate administrator's user context, the activity may appear normal to endpoint detection and response (EDR) solutions, making detection considerably more difficult. Although the public PoC does not directly expose credentials or password hashes, it provides a reliable mechanism for privilege escalation and long-term persistence on compromised systems.

Technical analysis indicates that LegacyHive exploits ProfSvc's registry hive loading process through the Windows Object Manager and registry loading routines. Process Monitor observations show that an initial attempt to access the target administrator's UsrClass.dat hive as a standard user fails with ACCESS DENIED, but a subsequent retry under an impersonated NT AUTHORITY\SYSTEM context succeeds, leaving the hive mounted and accessible. Researchers believe the exploit leverages Windows kernel-mediated impersonation and registry handling behavior, similar to techniques previously documented by Google Project Zero, allowing attackers to abuse trusted system processes to obtain SYSTEM-level effects and elevate privileges.

At the time of disclosure, LegacyHive reportedly affects all supported Windows desktop and server versions, including systems fully updated with the July 2026 Patch Tuesday releases. Microsoft has acknowledged the reports and is investigating the vulnerability, but no CVE identifier or official security update has yet been released. Since the flaw requires local access, attackers must first compromise a system or obtain a low-privileged account before exploitation. Until a patch becomes available, organizations should minimize local logon privileges for administrative accounts, separate privileged workstations from standard user environments, closely monitor registry hive modifications and COM registration changes, and investigate systems where LegacyHive or related NightmareEclipse exploitation tools are discovered, as they may indicate an active compromise.