Chaotic Eclipse Discloses “LegacyHive” Zero‑Day Privilege‑Escalation Flaw in Fully Patched Windows Systems
What Happened — Researcher “Chaotic Eclipse” released a proof‑of‑concept (PoC) for a new local privilege‑escalation vulnerability, dubbed LegacyHive, in the Windows User Profile Service (ProfSvc). The flaw allows a standard‑user attacker who already has a foothold on a machine to load another user’s registry hive—including that of a local administrator—into their own profile, potentially granting elevated rights. No CVE, advisory, or patch exists yet, despite the vulnerability appearing in the latest July 2026 Patch Tuesday release.
Why It Matters for Compliance & Audit Readiness
- Demonstrates how a post‑compromise privilege‑escalation scenario can bypass the logical‑access controls that SOC 2 CC6.1 requires organizations to design, enforce, and continuously monitor.
- Highlights the need for evidence‑ready controls (e.g., privileged‑account monitoring, just‑in‑time elevation, MFA) that can be audited in real time, a core capability of Verisq’s SOC 2 Access Controls offering.
Who Is Affected – Any organization running Windows 10/11 or Windows Server 2022/2025 that applied the July 2026 patches, across all verticals (finance, healthcare, SaaS, manufacturing, etc.).
Recommended Actions
- Review and tighten least‑privilege assignments for local accounts; enforce MFA for all privileged logons.
- Deploy continuous monitoring of ProfSvc activity and registry‑hive access events; collect logs as audit evidence.
- Conduct a privilege‑escalation tabletop to validate detection and response procedures.
- Map the scenario to SOC 2 CC6.1 controls and capture remediation steps in your compliance repository.
Source: Security Affairs
Technical Notes – The exploit is a local privilege‑escalation (no remote code execution). It requires: (a) existing code execution as a standard user, (b) valid credentials for a second local account, and (c) a third user profile whose hive can be mounted. Attackers can then read protected registry data and potentially gain SYSTEM rights. No CVE assigned yet; the vulnerability targets the User Profile Service (ProfSvc).