A fresh zero-day vulnerability in Windows has received unofficial patches from ACROS Security, the developer of the 0Patch platform, after Microsoft failed to release an official fix. The flaw, dubbed LegacyHive, affects the user profile service and currently lacks a CVE identifier.
The vulnerability was discovered by researcher Nightmare Eclipse and publicly disclosed on 14 July, the same day Microsoft issued its monthly security updates. LegacyHive permits a standard user to mount another user's registry hive with complete access rights. Once mounted, an attacker can extract stored credentials or alter registry values to achieve automatic code execution the next time an administrator logs in.
Exploit functionality has been independently verified by security researchers Will Dormann and Kevin Beaumont. Kevin Beaumont additionally published detection queries for Microsoft Defender for Endpoint to help organizations identify potential exploitation attempts.
Microsoft has confirmed awareness of the issue and is reviewing the details, yet no official patch has been issued. ACROS Security addressed the gap by releasing a free micro-patch that alters the behavior of the vulnerable component. The exploit still runs, but instead of accessing the real administrator profile it receives only a disposable temporary registry hive, rendering the attack ineffective.
The micro-patch is available for Windows 10 version 2004 and newer, as well as Windows Server 2022 and subsequent releases. Users must register with 0Patch and deploy the agent; once installed, the patch applies automatically without requiring a system reboot, provided enterprise policies permit it.
No evidence of in-the-wild exploitation of LegacyHive has been reported so far.
