Researchers Warn of Rapid Weaponization After NightmareEclipse Drops LegacyHive Zero-Day on Record Patch Tuesday

A stripped-down privilege escalation exploit for Windows was published on the same day Microsoft issued a record 622 fixes, and researchers fear attackers will quickly turn it into a fully weaponized tool.

This article was drafted with AI assistance from multiple sources and was reviewed and approved by a human editor before publication.

A prolific vulnerability researcher released a new Windows zero-day exploit on Tuesday, hours after Microsoft delivered its largest-ever Patch Tuesday update, raising concerns among security experts that the bug could soon be used in real-world attacks.

The exploit, called LegacyHive by its author NightmareEclipse, targets a local privilege escalation (LPE) vulnerability in the Windows User Profile Service (profsvc). It allows a low-privileged account to load another user's registry hive, including an administrator's, by abusing the ability to mount arbitrary registry hives.

The published proof-of-concept (PoC) has been deliberately limited: it requires additional user credentials and only works with the usrclass.dat hive. However, NightmareEclipse claimed that the original, unpublished PoC does not need extra credentials and can operate beyond the usrclass.dat hive.

LegacyHive was released without a CVE identifier. NightmareEclipse stated the exploit works on Windows machines that are fully patched with the July 2026 updates.

This is not the first time NightmareEclipse's work has been quickly adopted by malicious actors. The researcher's earlier zero-days BlueHammer and RedSun transitioned from proof-of-concept to widespread exploitation within days of publication. Security firm Huntress observed that NightmareEclipse's previous LPE and defense evasion tools were rapidly deployed by threat actors and ransomware groups shortly after they were released.

"Threat intelligence teams should act with urgency because capable attackers could quickly build a reliable exploit," said Dray Agha, senior manager of security operations at Huntress.

Microsoft earlier issued a quiet fix for another NightmareEclipse zero-day, RoguePlanet, around July 8, 2026, but did not release details. The company did not respond to questions about LegacyHive or whether a patch will be included before the August 2026 security updates.

Multiple researchers have confirmed the exploit works. Matei Badanoiu, lead security researcher at Pentest-Tools.com, described LegacyHive as "a genuinely useful primitive for attackers with a foothold, but falls short of full system compromise."

NightmareEclipse has now published nine zero-days in total, including LegacyHive.