# New zero-day targets Microsoft Windows: LegacyHive vulnerability disclosed Critical flaw allows attackers to access Windows user registry hives - **Source:** [www.theregister.com - Articles (theregister.co.uk)](https://brifing.si/source/e6d4ec13-4d0e-407a-b96d-39609d76c3b1) - **Published:** 2026-07-15 - **Topic:** [Software & Engineering](https://brifing.si/c/engineering) - **Original article:** - **On Brifing:** https://brifing.si/s/37dd6c36-ce09-4f41-be8b-fc9ce77ba4f6 ## New attack from zero-day hunter Microsoft's nemesis Nightmare Eclipse has published a new zero-day vulnerability targeting Windows user registry hives. Dubbed LegacyHive, this flaw exploits a weakness in the profsvc service to enable privilege escalation. The vulnerability allows attackers to access other users' system settings and configurations. ## Limited impact scope Security experts note that while the flaw could be useful for attackers already present in a system, it doesn't provide full system compromise. The published PoC is deliberately limited and requires additional credentials. However, skilled attackers could potentially complete the missing components to weaponize it. ## Strategic timing trap for Microsoft The disclosure came right after Microsoft's monthly Patch Tuesday updates, maximizing the exposure window before a fix can be developed. This tactic aims to put Microsoft in a difficult position. Previous similar vulnerabilities were quickly adopted by malware operators, according to security researchers. ## Did legal threats make a difference? Nightmare Eclipse's decision not to release a fully functional PoC this time might reflect Microsoft's legal action threats. However, the hunter claims the original PoC works without requiring additional credentials. Microsoft hasn't yet issued an official statement regarding this vulnerability. ## Urgent action call for security teams Cybersecurity professionals warn that capable attackers could complete the partial PoC. Huntress team reminds that previous similar flaws were rapidly weaponized by ransomware groups and recommends immediate defensive measures. The timeline for an official patch remains uncertain. ## Microsoft's ongoing security challenge LegacyHive works against systems fully patched with July updates, highlighting Microsoft's ongoing vulnerability management struggles. As a prime target for zero-day hunters, the company faces both technical and legal battles in maintaining system security. ## Sources covering this story - https://www.theregister.com/security/2026/07/15/microsofts-serial-tormentor-drops-legacyhive-0-day/5271723 — --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._