LegacyHive Windows zero-day drops as July Patch Tuesday ships

Hours after Microsoft wrapped its July 2026 Patch Tuesday rollout, a researcher going by Chaotic Eclipse published a proof-of-concept exploit called LegacyHive. It targets the Windows User Profile Service, the quiet background component that manages user accounts and environments, and uses it to load an arbitrary registry hive and escalate privileges. It works on every supported version of Windows, desktop and server, fully patched.

The published version is deliberately hobbled. It demands a second standard user credential and a third username, and it will only load the usrclass.dat hive. The researcher was clear that the original needed none of that and would cheerfully load whichever hive an attacker fancied. Consider it the polite edition.

A feud, not a disclosure

Chaotic Eclipse and Microsoft have been at odds since April. The researcher has repeatedly published technical detail before patches land, citing what they describe as broken communication with Redmond. Three earlier Defender bugs disclosed the same way were exploited in the wild shortly after. A recent fix for another Defender flaw, RoguePlanet, turned out to leak eight bytes of data when opening files under certain conditions, which is not the sort of thing that inspires confidence in either side of the relationship.

Microsoft says it is investigating LegacyHive. In the meantime the PoC is public, the caveats are documented, and anyone with a bit of patience can probably reconstruct the more capable version.

The rest of July was not quiet either

Microsoft patched a record 622 flaws this month. The headline items include two actively exploited privilege escalation bugs, one in SharePoint Server and one in Active Directory Federation Services. Both are now on CISA's Known Exploited Vulnerabilities list with tight federal remediation deadlines.

A separate SharePoint authentication bypass, CVE-2026-55040, carries a 9.1 severity score and stems from a broken JWT validation pipeline. For organisations still running on-premises SharePoint, the current picture is genuinely ugly. Multiple flaws are being chained in the wild to steal IIS machine keys and drop malware, which turns a single unpatched server into a durable foothold.

Where the pain actually lands

LegacyHive will get the coverage because it is a fresh zero-day on every Windows box in existence and it arrived with a bit of theatre. That is fair enough. But the operational damage this month is landing in SharePoint estates, where attackers are already inside and already monetising.

• LegacyHive: unpatched Windows LPE, PoC public, real severity depends on whether the researcher or someone else releases the un-nerfed version.
• SharePoint: two chained bug clusters under active exploitation, machine keys being lifted, malware being planted. Patch, rotate keys, and check what happened before you patched.
• AD FS: exploited privilege escalation on the KEV list. If it authenticates users into anything that matters, treat it as urgent.

Patch Tuesday used to be a routine bit of hygiene. This month it is a full inbox.