Vulnerability details
| CVE | CVSS | EPSS | KEV | PoC | PRS risk |
|---|---|---|---|---|---|
| CVE-2026-62832 | 7.8 | 3.3% | — | — | 45.94 (Medium) |
LegacyHive: Windows Profile Initialization LPE via Offline Registry Manipulation
Nightmare-Eclipse has released LegacyHive, a new Windows proof-of-concept for CVE-2026-62832, a local privilege escalation vulnerability in the Windows User Profile Service. The exploit works by manipulating the user profile registry hive offline, bypassing the standard link-following checks that normally gate file access.
The vulnerability carries a CVSS 7.8 score and is rated as an Important patch. It allows an authorized attacker to elevate privileges locally by exploiting improper link resolution before file access. EPSS sits at 3.3% (88th percentile), and no KEV entry or prior public PoC has been assigned. The PRS risk score is 45.94, placing it in the Medium band.
LegacyHive drops immediately after July 2026 Patch Tuesday, following the series' typical cadence. It is the ninth release in the Nightmare-Eclipse lineup, following BlueHammer, RedSun, UnDefend, YellowKey, GreenPlasma, MiniPlasma, GreatXML, and RoguePlanet.
How the Exploit Works
The exploit begins with the attacker creating a new user profile, then swapping the registry hive offline to inject a malicious link. When the user logss in, the User Profile Service loads the tampered hive, triggering the LPE. Elevation to SYSTEM or admin happens without an interactive UAC prompt, typical for this class of bug.
The CVE and Severity
The vulnerability is assigned CVE-2026-62832 and carries a CVSS 3.1 score of 7.8, placing it in the High band. NVD describes it as an improper link resolution before file access in the Windows User Profile Service, allowing an authorized attacker to elevate privileges locally.
EPSS sits at 3.3% (88th percentile), indicating a moderate probability of exploitation in the wild. The PRS risk score is 45.94, which lands in the Medium band. No KEV listing has been published yet, and the PoC is public as of the July 2026 release.
Where It Fits in the Series
LegacyHive is the tenth entry in the Nightmare-Eclipse series, landing after BlueHammer, RedSun, UnDefend, YellowKey, GreenPlasma, MiniPlasma, GreatXML, and RoguePlanet. ShieldBreak, the eleventh release, drops in August 2026, confirming the monthly cadence the persona has maintained since the first public drop.
Every tool in the lineup is a local privilege escalation proof-of-concept targeting a different Windows subsystem. LegacyHive hits the User Profile Service, which handles the offline registry hive swap that gates file access via link-following checks.
Key points
- LegacyHive is a new Windows User Profile Service LPE PoC from the Nightmare-Eclipse persona.
- Exploits offline registry manipulation to elevate from standard user to SYSTEM.
- Assigned CVE-2026-62832 with CVSS 7.8 (3.1) and EPSS 3.3% (88th percentile).
- Released right after July 2026 Patch Tuesday; no patch was available at disclosure time.
- Tenth release in the series after BlueHammer, RedSun, UnDefend, YellowKey, GreenPlasma, MiniPlasma, GreatXML, RoguePlanet, and LegacyHive.