Nightmare Eclipse Drops ‘LegacyHive’ Windows Zero-Day

The researcher stripped the proof-of-concept (PoC) exploit to prevent immediate exploitation of the vulnerability. The post Nightmare Eclipse Drops ‘LegacyHive’ Windows Zero-Day appeared first on SecurityWeek .

The article reports that the researcher "Nightmare Eclipse" released a stripped-down proof-of-concept for a new Windows local privilege escalation zero‑day dubbed LegacyHive, abusing the Windows User Profile Service’s hive-loading behavior to let a standard user mount and modify another user’s registry hive, potentially an administrator’s.[1][3][6] According to public reports, the PoC is intentionally limited (e.g., requiring additional credentials and focusing on usrclass.dat), but the researcher claims to have a more powerful private exploit capable of arbitrary hive loading on fully patched Windows systems.[1][3] From a RealGround perspective, this kind of publicly dropped, partially weaponized zero‑day creates a high‑risk environment for automated and AI‑driven Windows management or response agents: they may run under low-privilege accounts that attackers can escalate via such exploits, so organizations should incorporate continuous red teaming and exploit simulation against their AI-assisted operational tooling to ensure privilege boundaries, registry access patterns, and agent execution contexts remain robust under adversarial conditions.