Non-admin users can escalate privileges to administrator via Windows User Profile Service flaw

Summary

A security researcher known as Nightmare Eclipse has disclosed a privilege escalation flaw within the Windows User Profile Service. The vulnerability, referred to as LegacyHive, enables a standard user to mount another user's registry hive with full access permissions. This allows for the extraction of stored secrets or the modification of registry values to trigger code execution during subsequent administrative logins.

The disclosure coincided with Microsoft's July 2026 Patch Tuesday updates. While the vulnerability is currently unassigned a CVE ID, researchers have released a stripped proof-of-concept (PoC) designed to prevent easier weaponization by threat actors. Microsoft has stated it is actively investigating the validity and potential applicability of these claims.

Technical details

The LegacyHive flaw centers on the ability of a regular, non-privileged user to mount any other user's registry hive in full access mode. By gaining this level of access, an attacker can manipulate the classes registry hive to influence what executes the next time an administrator logs into that specific device.

According to ACROS Security, the vulnerability impacts systems running Windows 10 2004 or later, as well as Windows Server 2022 or later. While unofficial patches are being deployed, the exploit remains functional under certain conditions; however, when a 0patch is active, the exploit appears to load a temporary user profile hive instead of the intended administrator hive, rendering the attack ineffective for its primary goal.

Detection

Security researchers have published Kusto Query Language (KQL) queries to identify exploitation attempts within Microsoft Defender for Endpoint environments. These detections focus on three specific behaviors:

1. Temporary GUID Directory Creation This query identifies the creation of temporary GUID directories in the root of the system drive, which is used to stage registry files.

DeviceFileEvents
| where FolderPath matches regex @"^[a-zA-Z]:\\[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$"
| where FileName in~ ("ntuser.dat", "usrclass.dat")
| project TimeGenerated, DeviceName, ActionType, FolderPath, FileName, InitiatingProcessFileName, InitiatingProcessCommandLine

2. Registry Key Modification This query looks for modifications to the "User Shell Folders" key that point to virtual device paths, a known indicator of this exploit.

DeviceRegistryEvents
| where RegistryKey has @"Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders"
| where RegistryValueName in~ ("Local AppData", "AppData", "Cache", "Cookies", "History")
| where RegistryValueData has @"\\.\globalroot" or RegistryValueData has @"\BaseNamedObjects"
| project TimeGenerated, DeviceName, RegistryKey, RegistryValueName, RegistryValueData, InitiatingProcessFileName, InitiatingProcessAccountName

3. Offreg.dll Loading The exploit relies on loading offreg.dll (Offline Registry Library), which is typically not used by standard user-space applications outside of specific system installation or configuration tools.

DeviceImageLoadEvents
| where FileName =~ "offreg.dll"
| where not(InitiatingProcessFolderPath has_any(@"\System32\", @"\SysWOW64\", @"\WinSxS\"))
| where not(InitiatingProcessFolderPath startswith "c:\\programdata\\microsoft\\windows defender")
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessFolderPath, InitiatingProcessCommandLine

Defender guidance

Immediate action depends on your current patching and monitoring capabilities.

• Apply Unofficial Patches: For systems running Windows 10 2004+ or Windows Server 2022+, ACROS Security provides free micropatches via the 0patch agent. This can be deployed without a system restart.
• Deploy Detection Queries: If using Microsoft Defender for Endpoint, deploy the KQL queries provided above to monitor for staging behaviors, registry modifications, and suspicious offreg.dll loads.
• Monitor Administrative Logins: Because the goal of this exploit is to execute code when an administrator logs in, heightened monitoring of administrative session starts on high-value workstations is advised.