What Changed
Microsoft’s August Patch Tuesday fixes “LegacyHive,” a Windows zero-day that the researcher known as Nightmare Eclipse disclosed with a proof-of-concept exploit right after July’s updates. It is now tracked as CVE-2026-62832, a link-following flaw in the Windows User Profile Service that lets a local attacker gain administrator privileges.
According to Microsoft, exploitation requires credentials for another local account. Microsoft credits an anonymous researcher rather than Nightmare Eclipse.
How The Exploit Works
Vulnerability analyst Will Dormann explained that a non-admin user can modify the classes registry hive and gain automatic code execution when an administrator logs in. Kevin Beaumont published detection queries for Microsoft Defender for Endpoint. 0patch has offered micropatches since July 20 for Windows 10 version 2004 and later and Windows Server 2022 and later.
Know what matters before your first meeting.
Weekday mornings. Five minutes. What changed in security, why it matters.
By subscribing you agree to our Privacy Policy.
Free. Weekday mornings. 5 minutes or less.
Why This Is An Operations Problem
Shared machines where administrators log in interactively, such as jump hosts, terminal servers and IT workstations, are where this matters most. Because exploitation requires a second local account’s credentials, the flaw is a post-compromise step rather than an entry point.
What To Verify First
- Deploy the August cumulative updates, prioritizing multi-user systems.
- Run the published detection queries for LegacyHive activity since mid-July.
- Reduce interactive admin logons on machines that standard users also use.
- Check whether 0patch micropatches were deployed as a stopgap and plan their retirement once the official update is installed.
- Audit which machines have more than one local account, since the attack depends on a second account’s credentials.
What Teams May Be Underestimating
Local privilege escalation bugs are how a phishing foothold becomes domain-wide access. Public exploit code was available from mid-July until the August fix, a long window for attackers to use it. Systems that missed the August update remain exposed.
Source Context
This item was rebuilt from the following primary sources and original reporting:
Know what matters before your first meeting.
Weekday mornings. Five minutes. What changed in security, why it matters.
By subscribing you agree to our Privacy Policy.
Free. Weekday mornings. 5 minutes or less.
Related In The Daily Brief
See this item in The 5-Minute Cyber Brief
Newer CyberExperts coverage on this topic
This article still works as background. If you want the current picture, start with the freshest related coverage below and today's brief.
Coder’s registry infrastructure compromised to push malicious modules
The Coder incident is a supply-chain lesson in miniature: once attackers can tamper with trusted module distribution, defenders are no longer verifying...
Attackers Turn Trusted Node.js Runtime Into Malware Delivery Tool in Targeted Attacks
The useful lesson in this campaign is not that Node.js is bad. It is that adversaries keep choosing legitimate runtimes defenders already...
HPE patches critical ArubaOS-CX remote code execution flaw
ArubaOS-CX deserves attention because switching software rarely gets treated with the same urgency as identity or edge security until exploitation arrives. A...
Thursday’s brief: Cisco email gateways under attack, then PAN-OS, Nextcloud and AhsayCBS
The fastest way to catch up on what changed after this article was published.
Start your morning with the signal that matters.
Get the biggest cybersecurity developments, why they matter, and where to go deeper on CyberExperts.
By subscribing you agree to our Privacy Policy.
Free. Weekdays. Built for operators.
