Back to threat alerts

LegacyHive Zero-Day: Privilege Escalation Exploiting Windows

Within hours of Microsoft releasing its monthly security updates on July 15, 2026, a critical zero-day vulnerability dubbed "LegacyHive" was publicly disclosed. The exploit takes advantage of a logic flaw in the Windows User Profile Service (profsvc), enabling a low-privileged standard user to deceive the SYSTEM-level service into mounting another user's registry hive with read privileges.

Threat alert
July 17, 2026
The Exploit Chain

LegacyHive operates by manipulating the complex interactions between the Windows Object Manager, the Offline Registry Library, and the User Profile Service. The current public proof-of-concept requires the credentials of a secondary standard "helper" account to execute.

  • ‍Environment Staging: The malware creates a temporary directory with a highly permissive Discretionary Access Control List (DACL) at the root of the system drive (e.g., C:\<GUID>\). It then places a copy of the helper user's UsrClass.dat hive into this directory to serve as a decoy.‍
  • Object Manager Poisoning: Interfacing directly with the Windows Object Manager, the exploit creates virtual directories and symbolic links within the highly privileged \BaseNamedObjects namespace. By utilizing the \\.\GlobalRoot prefix, it bypasses standard Win32 path sanitization, ensuring that any process attempting to resolve the poisoned virtual path is redirected to the physical staging directory on the hard drive. A secondary shadow directory is also created as a fallback, pointing directly to the target administrator's physical profile.‍
  • Offline Registry Manipulation: Using the Offline Registry Library (offreg.dll), the exploit modifies a backup of the helper user's NTUSER.DAT without formally mounting it. It changes the Local AppData registry value so that the dynamic path points to the poisoned Object Manager namespace.‍
  • The TOCTOU Race Condition: To escalate privileges, the exploit must win a Time-of-Check to Time-of-Use (TOCTOU) race condition against the profsvc service. It places an Opportunistic Lock (specifically a batch oplock) on the decoy hive in the staging directory. The exploit then invokes CreateProcessWithLogonW to force an interactive logon for the helper account, causing the SYSTEM-level service to request access to the file.‍
  • Hive Swapping Execution: The exact microsecond the SYSTEM process requests access, the oplock forcefully suspends the thread. While the thread is paused, the exploit deletes the primary symbolic link and releases the lock. When the kernel awakens the profsvc thread, the Object Manager's path resolution defaults to the fallback mechanism, seamlessly mounting the target administrator's actual registry hive. Because this action is performed by NT AUTHORITY\SYSTEM, all standard access restrictions are bypassed.

‍

Recommendations
  • Restrict Secondary Accounts: The current exploit requires explicit credentials for a secondary standard user to initiate the interactive logon sequence. Security teams should rigorously audit fleets to disable or remove unnecessary local accounts, secondary domain profiles, and shared administrative accounts.
  • Enforce Application Control: Utilise Windows Defender Application Control (WDAC) or Microsoft AppLocker to enforce strict execution policies. Prohibiting the execution of unsigned binaries or scripts from user-writable directories (such as C:\ or %TEMP%) can block the LegacyHive payload regardless of its privilege escalation capabilities.
  • Enhance Audit Policies: Detection relies entirely on high-fidelity telemetry. Security architects must ensure advanced auditing is enabled via Group Policy, specifically forwarding Audit Process Creation (Event ID 4688 with command-line auditing) and Audit Object Access (Event ID 4663, narrowly scoped to user hive files via System Access Control Lists) to the SIEM.