--- title: New Windows LegacyHive zero-day gives hackers admin... description: A security researcher known as 'Nightmare Eclipse' has released a Windows zero-day exploit called LegacyHive that enables local privilege escalation on fully... canonical: https://daily.dev/posts/new-windows-legacyhive-zero-day-gives-hackers-admin-privileges-ghvh8jjsu twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: New Windows LegacyHive zero-day gives hackers admin privileges | daily.dev og:description: A security researcher known as 'Nightmare Eclipse' has released a Windows zero-day exploit called LegacyHive that enables local privilege escalation on fully... og:url: https://daily.dev/posts/new-windows-legacyhive-zero-day-gives-hackers-admin-privileges-ghvh8jjsu og:image: https://api.daily.dev/og/posts/ghvH8JJsU.png og:image:alt: New Windows LegacyHive zero-day gives hackers admin privileges og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # New Windows LegacyHive zero-day gives hackers admin privileges **[BleepingComputer](https://daily.dev/sources/bleepingcomputer)** · 3 min read · 0 upvotes · 0 comments ## Summary A security researcher known as 'Nightmare Eclipse' has released a Windows zero-day exploit called LegacyHive that enables local privilege escalation on fully patched Windows systems. The exploit targets a vulnerability in the Windows User Profile Service (no CVE assigned yet) and was published shortly after Microsoft's July 2026 Patch Tuesday. The PoC was intentionally stripped down to require additional credentials, limiting easy weaponization. Successful exploitation lets non-admin users modify the classes registry hive and gain code execution when an admin logs in. Cybersecurity expert Kevin Beaumont published detection queries for Microsoft Defender for Endpoint. This is the latest in a series of zero-day disclosures by Nightmare Eclipse, with Microsoft having previously threatened legal action against those causing harm to customers. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Similar posts on daily.dev - [Microsoft feud escalates as researcher drops new Windows zero-day](https://daily.dev/posts/microsoft-feud-escalates-as-researcher-drops-new-windows-zero-day-3qmkx9mgs) · CSO Online · 1 upvotes · 0 comments - [Microsoft Defender 'RoguePlanet' zero-day grants SYSTEM privileges](https://daily.dev/posts/microsoft-defender-rogueplanet-zero-day-grants-system-privileges-ldyxflycj) · BleepingComputer · 1 upvotes · 0 comments - [Nightmare-Eclipse Strikes Again with 'ShieldCrash' Windows Exploit](https://daily.dev/posts/nightmare-eclipse-strikes-again-with-shieldcrash-windows-exploit-3pp4wzefx) · Dark Reading · 0 upvotes · 0 comments --- Tags: [#windows](https://daily.dev/tags/windows), [#zero-day](https://daily.dev/tags/zero-day) [View this post on daily.dev](https://daily.dev/posts/new-windows-legacyhive-zero-day-gives-hackers-admin-privileges-ghvh8jjsu) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"New Windows LegacyHive zero-day gives hackers admin privileges","url":"https://daily.dev/posts/new-windows-legacyhive-zero-day-gives-hackers-admin-privileges-ghvh8jjsu","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/new-windows-legacyhive-zero-day-gives-hackers-admin-privileges-ghvh8jjsu"},"datePublished":"2026-07-17T11:09:25.721Z","dateModified":"2026-07-21T08:49:53.237Z","description":"A security researcher known as 'Nightmare Eclipse' has released a Windows zero-day exploit called LegacyHive that enables local privilege escalation on fully...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/51bedf12208ce5d455984c7ec13b9967?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/51bedf12208ce5d455984c7ec13b9967?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"BleepingComputer","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"BleepingComputer","logo":"https://media.daily.dev/image/upload/s--as8nJ3qy--/f_auto,q_auto/v1774959951/logos/bleepingcomputer?_a=BAMAMiWQ0","url":"https://daily.dev/sources/bleepingcomputer"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/new-windows-legacyhive-zero-day-gives-hackers-admin-privileges-ghvh8jjsu","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"windows,zero-day","timeRequired":"PT3M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"BleepingComputer","item":"https://daily.dev/sources/bleepingcomputer"},{"@type":"ListItem","position":3,"name":"New Windows LegacyHive zero-day gives hackers admin privileges"}]} ```