Researcher Drops New Windows Zero-Day PoC Hours After Microsoft Patch Tuesday

Security researcher Chaotic Eclipse (aka Nightmare-Eclipse) has released a new proof-of-concept (PoC) exploit called LegacyHive. It has been described as a Windows User Profile Service arbitrary hive load elevation of privileges vulnerability. The Windows User Profile Service, also referred to as ProfSvc, is a core system component that manages user accounts and environments. "The PoC requires

The article reports that security researcher Chaotic/Nightmare Eclipse has released a new Windows local privilege-escalation zero-day PoC, "LegacyHive," abusing the Windows User Profile Service (ProfSvc) to mount another user's registry hive (usrclass.dat), potentially including an administrator's, into a low-privilege user's classes root on fully patched Windows desktop and server builds as of July 2026.[1][2][3][9] The public PoC currently requires extra user credentials and is partially limited, while the researcher claims to have a more powerful private variant capable of arbitrary hive loading that has not been released.[2][5][9] From a RealGround perspective, public LPE PoCs like LegacyHive are high-risk enablers for malicious AI use, as offensive AI agents and automated exploitation pipelines can rapidly incorporate such primitives to escalate privileges, tamper with security controls, and access sensitive system configuration and credentials at scale. Organizations should prioritize hardening Windows endpoints, monitor for anomalous registry hive activity, and use Continuous AI Red Teaming to test whether internal or third-party AI-powered tools could be coerced into di