Zero‑Day Privilege‑Escalation Flaw “LegacyHive” Targets Windows User Profile Service, Unofficial Micropatches Released
What Happened – A newly disclosed Windows privilege‑escalation vulnerability, dubbed LegacyHive, allows a non‑admin user to mount another user’s registry hive, extract secrets, and inject code that runs when an admin logs in. Microsoft has not yet issued a CVE or official patch; free unofficial “micropatches” are being distributed by ACROS Security’s 0Patch platform.
Why It Matters for Compliance & Audit Readiness –
- The flaw directly subverts the SOC 2 Access Controls principle that only authorized users may modify system configurations or access privileged data.
- Continuous‑compliance programs must demonstrate that privileged‑access policies are enforced, that anomalous registry activity is logged, and that any interim mitigation (e.g., unofficial patches) is documented as audit evidence.
Who Is Affected – Enterprises across all sectors that run Windows 10 2004 / Windows Server 2019 or later, including finance, healthcare, SaaS, and cloud‑infrastructure providers.
Recommended Actions –
- Map the vulnerability to SOC 2 CC6.1 (Logical Access) and CC6.2 (Least‑Privilege) controls; verify that privileged‑access policies prohibit non‑admin registry modifications.
- Deploy detection rules (e.g., Microsoft Defender for Endpoint queries) to alert on unexpected hive‑mount activity.
- Consider interim mitigation with ACROS 0Patch micropatches, but log the change, validate compatibility with your change‑management process, and retain evidence for audit.
- Prioritize Microsoft’s forthcoming patch; update your patch‑management schedule accordingly.
Technical Notes – The exploit targets the Windows User Profile Service, enabling a non‑admin user to load any user’s registry hive in full‑access mode. No CVE ID has been assigned; the proof‑of‑concept was released on the same day as Microsoft’s July 2026 Patch Tuesday. ACROS’s micropatch injects code to redirect the hive load to a temporary profile, neutralizing the attack path. Source: BleepingComputer