# Researcher Discloses New Windows Zero-Day Hours After Microsoft's Patch Tuesday A new Windows vulnerability targets user profiles, raising security concerns. - **Source:** [The Hacker News](https://brifing.si/source/f944ec2b-8180-47bc-94de-57085b5a6563) - **Published:** 2026-07-15 - **Topic:** [Software & Engineering](https://brifing.si/c/engineering) - **Original article:** - **On Brifing:** https://brifing.si/s/1edeaa7d-e99e-4100-882d-87d322aea901 ## New Windows Vulnerability Revealed Security researcher Chaotic Eclipse disclosed a new Windows vulnerability (LegacyHive) just hours after Microsoft's July 2026 Patch Tuesday update. This flaw allows privilege escalation through the Windows User Profile Service and affects all supported Windows versions, enabling unauthorized access to user profiles. ## How the Exploit Works The LegacyHive vulnerability targets the ProfSvc service, which manages user profiles in Windows. An attacker can use another user's credentials to access the target user's registry hive. The researcher limited the PoC to prevent abuse but noted the original exploit had a broader impact. ## Tension Between Researcher and Microsoft Chaotic Eclipse and Microsoft have been in conflict since April 2026, with the researcher disclosing multiple vulnerabilities before patches were released. This led to active exploitation of three Microsoft Defender flaws. Microsoft is now investigating the new report. ## SharePoint Servers Also at Risk Microsoft's July update also patches two critical SharePoint Server flaws allowing unauthorized access and remote code execution. CISA added these to its KEV catalog, requiring federal agencies to apply fixes promptly. All supported SharePoint versions are affected. ## Authentication Bypass Issue The CVE-2026-55040 flaw in SharePoint bypasses authentication due to JWT token validation errors, enabling attackers to perform operations with admin privileges. Rapid7 warns this could be chained with other vulnerabilities. Internet-facing SharePoint servers are particularly vulnerable. ## Importance of Security Updates Microsoft's July update addresses 622 flaws in total. However, researchers found some patches might introduce new issues, such as data leaks in Defender's RoguePlanet fix. Promptly applying updates remains critical for users to mitigate risks. ## Sources covering this story - https://thehackernews.com/2026/07/researcher-drops-new-windows-zero-day.html — --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._