Researcher Discloses New Windows Zero-Day Hours After Microsoft's Patch Tuesday
A new Windows vulnerability targets user profiles, raising security concerns.
1New Windows Vulnerability Revealed
Security researcher Chaotic Eclipse disclosed a new Windows vulnerability (LegacyHive) just hours after Microsoft's July 2026 Patch Tuesday update. This flaw allows privilege escalation through the Windows User Profile Service and affects all supported Windows versions, enabling unauthorized access to user profiles.
2How the Exploit Works
The LegacyHive vulnerability targets the ProfSvc service, which manages user profiles in Windows. An attacker can use another user's credentials to access the target user's registry hive. The researcher limited the PoC to prevent abuse but noted the original exploit had a broader impact.
3Tension Between Researcher and Microsoft
Chaotic Eclipse and Microsoft have been in conflict since April 2026, with the researcher disclosing multiple vulnerabilities before patches were released. This led to active exploitation of three Microsoft Defender flaws. Microsoft is now investigating the new report.
4SharePoint Servers Also at Risk
Microsoft's July update also patches two critical SharePoint Server flaws allowing unauthorized access and remote code execution. CISA added these to its KEV catalog, requiring federal agencies to apply fixes promptly. All supported SharePoint versions are affected.
5Authentication Bypass Issue
The CVE-2026-55040 flaw in SharePoint bypasses authentication due to JWT token validation errors, enabling attackers to perform operations with admin privileges. Rapid7 warns this could be chained with other vulnerabilities. Internet-facing SharePoint servers are particularly vulnerable.
6Importance of Security Updates
Microsoft's July update addresses 622 flaws in total. However, researchers found some patches might introduce new issues, such as data leaks in Defender's RoguePlanet fix. Promptly applying updates remains critical for users to mitigate risks.