Executive Summary
In July 2026, security researcher Chaotic Eclipse (also known as Nightmare-Eclipse) publicly disclosed a Windows zero-day vulnerability dubbed 'LegacyHive' impacting the Windows User Profile Service (ProfSvc). The vulnerability allows a standard user to load another user's registry hive (e.g., NTUSER.DAT or UsrClass.dat) into their own classes root, potentially bypassing security boundaries and enabling further escalation. This disclosure follows a series of disputes between the researcher and Microsoft, with the PoC reportedly functional on systems fully patched as of July 2026.
Simultaneously, Microsoft addressed a record 622 flaws, including several actively exploited vulnerabilities in SharePoint Server (CVE-2026-56164) and Active Directory Federation Services (CVE-2026-56155). CISA has mandated federal agencies to patch these exploited flaws immediately. The LegacyHive disclosure underscores a volatile threat landscape where public PoC releases for unpatched OS components are increasing friction between researchers and vendors.