--- title: Windows LegacyHive zero-day flaw gets free, unofficial... description: A Windows zero-day vulnerability dubbed LegacyHive, found in the Windows User Profile Service, allows non-admin users to mount any other user's registry hive... canonical: https://daily.dev/posts/windows-legacyhive-zero-day-flaw-gets-free-unofficial-patches-5czcrm4fv twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Windows LegacyHive zero-day flaw gets free, unofficial patches | daily.dev og:description: A Windows zero-day vulnerability dubbed LegacyHive, found in the Windows User Profile Service, allows non-admin users to mount any other user's registry hive... og:url: https://daily.dev/posts/windows-legacyhive-zero-day-flaw-gets-free-unofficial-patches-5czcrm4fv og:image: https://api.daily.dev/og/posts/5CzcrM4fv.png og:image:alt: Windows LegacyHive zero-day flaw gets free, unofficial patches og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Windows LegacyHive zero-day flaw gets free, unofficial patches **[BleepingComputer](https://daily.dev/sources/bleepingcomputer)** · 3 min read · 0 upvotes · 0 comments ## Summary A Windows zero-day vulnerability dubbed LegacyHive, found in the Windows User Profile Service, allows non-admin users to mount any other user's registry hive with full access, enabling secret extraction or registry modification to achieve code execution when an admin logs in. Discovered by researcher 'Nightmare Eclipse' and disclosed on Microsoft's July 2026 Patch Tuesday, the flaw has no CVE ID yet and Microsoft is still investigating. Security expert Kevin Beaumont confirmed the exploit works and published detection queries for Microsoft Defender for Endpoint. While Microsoft has not released an official patch, ACROS Security's 0Patch platform offers free unofficial micropatches for Windows 10 2004 and later, deployable without a system restart. This is one of several unpatched zero-days disclosed by Nightmare Eclipse in recent months targeting Windows components, Defender, and BitLocker. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Similar posts on daily.dev - [Microsoft feud escalates as researcher drops new Windows zero-day](https://daily.dev/posts/microsoft-feud-escalates-as-researcher-drops-new-windows-zero-day-3qmkx9mgs) · CSO Online · 1 upvotes · 0 comments - [Microsoft Defender 'RoguePlanet' zero-day grants SYSTEM privileges](https://daily.dev/posts/microsoft-defender-rogueplanet-zero-day-grants-system-privileges-ldyxflycj) · BleepingComputer · 1 upvotes · 0 comments - [Nightmare-Eclipse Strikes Again with 'ShieldCrash' Windows Exploit](https://daily.dev/posts/nightmare-eclipse-strikes-again-with-shieldcrash-windows-exploit-3pp4wzefx) · Dark Reading · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#windows](https://daily.dev/tags/windows), [#zero-day](https://daily.dev/tags/zero-day) [View this post on daily.dev](https://daily.dev/posts/windows-legacyhive-zero-day-flaw-gets-free-unofficial-patches-5czcrm4fv) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Windows LegacyHive zero-day flaw gets free, unofficial patches","url":"https://daily.dev/posts/windows-legacyhive-zero-day-flaw-gets-free-unofficial-patches-5czcrm4fv","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/windows-legacyhive-zero-day-flaw-gets-free-unofficial-patches-5czcrm4fv"},"datePublished":"2026-07-21T08:08:30.959Z","dateModified":"2026-07-21T08:49:54.564Z","description":"A Windows zero-day vulnerability dubbed LegacyHive, found in the Windows User Profile Service, allows non-admin users to mount any other user's registry hive...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/0a45e526c4e39ea4518613b4ec4019ad?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/0a45e526c4e39ea4518613b4ec4019ad?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"BleepingComputer","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"BleepingComputer","logo":"https://media.daily.dev/image/upload/s--as8nJ3qy--/f_auto,q_auto/v1774959951/logos/bleepingcomputer?_a=BAMAMiWQ0","url":"https://daily.dev/sources/bleepingcomputer"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/windows-legacyhive-zero-day-flaw-gets-free-unofficial-patches-5czcrm4fv","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,windows,zero-day","timeRequired":"PT3M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"BleepingComputer","item":"https://daily.dev/sources/bleepingcomputer"},{"@type":"ListItem","position":3,"name":"Windows LegacyHive zero-day flaw gets free, unofficial patches"}]} ```