Windows Lacks Official Patch for LegacyHive Zero-Day; 0Patch Delivers Free Micro-Patch
A zero-day vulnerability named LegacyHive has been discovered in the Windows user profile service, allowing any standard user to mount another user's registry hive with full access. The flaw was reported on July 14 by researcher Nightmare Eclipse, coinciding with Microsoft's Patch Tuesday, and enables extraction of stored secrets or persistence by modifying registry settings that execute code on the next administrator login. Microsoft has acknowledged the issue and is investigating, but no official fix has been released yet. ACROS Security stepped in with a free micro-patch through its 0Patch platform that neutralizes the exploit by redirecting it to a harmless temporary hive instead of the administrator profile. The protection is available for Windows 10 version 2004 and later, as well as Windows Server 2022 and newer releases, and requires only registration and agent installation without a reboot. Researchers Will Dormann and Kevin Beaumont have independently confirmed the exploit's functionality, with Beaumont also publishing Microsoft Defender for Endpoint queries to detect related attacks.
AntiMalwareJul 21, 2026Translated from Russian