[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fQhPymg8Cm4fplJzCbjv1DWYGwL2V0XjyvNqNAjqW5q8":3,"$fSKaS5pkpCMTVLw6lyC9tkY76P1bc4Up6j9VdaVhE54o":38},{"article":4},{"slug":5,"title":6,"subtitle":7,"summary":8,"tags":9,"body_md":15,"hero_image_url":16,"structured":17,"story_type":34,"created_at":35,"updated_at":36,"published_at":37},"nightmare-eclipse-discloses-legacyhive-windows-lpe-poc","Nightmare-Eclipse Discloses LegacyHive Windows LPE PoC","New offline registry manipulation exploit for Windows User Profile Service, CVE-2026-62832, CVSS 7.8","The Nightmare-Eclipse persona has released LegacyHive, a local privilege escalation PoC for Windows User Profile Service that abuses offline registry manipulation, following the July 2026 Patch Tuesday.",[10,11,12,13,14],"Windows","LPE","PoC","CVE-2026-62832","Nightmare-Eclipse","# Nightmare-Eclipse Discloses LegacyHive Windows LPE PoC\n\n*New offline registry manipulation exploit for Windows User Profile Service, CVE-2026-62832, CVSS 7.8*\n\n**Tags:** `Windows` `LPE` `PoC` `CVE-2026-62832` `Nightmare-Eclipse`\n\n> The Nightmare-Eclipse persona has released LegacyHive, a local privilege escalation PoC for Windows User Profile Service that abuses offline registry manipulation, following the July 2026 Patch Tuesday.\n\n---\n\n## Vulnerability details\n\n| CVE | CVSS | EPSS | KEV | PoC | PRS risk |\n|---|---|---|---|---|---|\n| CVE-2026-62832 | 7.8 | 3.3% | — | — | 45.94 (Medium) |\n\n## LegacyHive: Windows Profile Initialization LPE via Offline Registry Manipulation\n\nNightmare-Eclipse has released LegacyHive, a new Windows proof-of-concept for CVE-2026-62832, a local privilege escalation vulnerability in the Windows User Profile Service. The exploit works by manipulating the user profile registry hive offline, bypassing the standard link-following checks that normally gate file access.\n\nThe vulnerability carries a CVSS 7.8 score and is rated as an Important patch. It allows an authorized attacker to elevate privileges locally by exploiting improper link resolution before file access. EPSS sits at 3.3% (88th percentile), and no KEV entry or prior public PoC has been assigned. The PRS risk score is 45.94, placing it in the Medium band.\n\nLegacyHive drops immediately after July 2026 Patch Tuesday, following the series' typical cadence. It is the ninth release in the Nightmare-Eclipse lineup, following BlueHammer, RedSun, UnDefend, YellowKey, GreenPlasma, MiniPlasma, GreatXML, and RoguePlanet.\n\n## How the Exploit Works\n\nThe exploit begins with the attacker creating a new user profile, then swapping the registry hive offline to inject a malicious link. When the user logss in, the User Profile Service loads the tampered hive, triggering the LPE. Elevation to SYSTEM or admin happens without an interactive UAC prompt, typical for this class of bug.\n\n## The CVE and Severity\n\nThe vulnerability is assigned CVE-2026-62832 and carries a CVSS 3.1 score of 7.8, placing it in the High band. NVD describes it as an improper link resolution before file access in the Windows User Profile Service, allowing an authorized attacker to elevate privileges locally.\n\nEPSS sits at 3.3% (88th percentile), indicating a moderate probability of exploitation in the wild. The PRS risk score is 45.94, which lands in the Medium band. No KEV listing has been published yet, and the PoC is public as of the July 2026 release.\n\n## Where It Fits in the Series\n\nLegacyHive is the tenth entry in the Nightmare-Eclipse series, landing after BlueHammer, RedSun, UnDefend, YellowKey, GreenPlasma, MiniPlasma, GreatXML, and RoguePlanet. ShieldBreak, the eleventh release, drops in August 2026, confirming the monthly cadence the persona has maintained since the first public drop.\n\nEvery tool in the lineup is a local privilege escalation proof-of-concept targeting a different Windows subsystem. LegacyHive hits the User Profile Service, which handles the offline registry hive swap that gates file access via link-following checks.\n\n## Key points\n\n- LegacyHive is a new Windows User Profile Service LPE PoC from the Nightmare-Eclipse persona.\n- Exploits offline registry manipulation to elevate from standard user to SYSTEM.\n- Assigned CVE-2026-62832 with CVSS 7.8 (3.1) and EPSS 3.3% (88th percentile).\n- Released right after July 2026 Patch Tuesday; no patch was available at disclosure time.\n- Tenth release in the series after BlueHammer, RedSun, UnDefend, YellowKey, GreenPlasma, MiniPlasma, GreatXML, RoguePlanet, and LegacyHive.\n\n## Further reading & sources\n\n- [August 2026 Patch Tuesday: Updates and Analysis | CrowdStrike](https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fblog\u002Fpatch-tuesday-analysis-august-2026)\n- [Cloud Sync Root RegistrationShieldBreak: Hunting Windows Defender Remediation Abuse and Cloud Files Hijacking](https:\u002F\u002Fwww.levelblue.com\u002Fblogs\u002Fspiderlabs-blog\u002Fcloud-sync-root-registrationshieldbreak-hunting-windows-defender-remediation-abuse-and-cloud-files-hijacking)","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fnightmare-eclipse-discloses-legacyhive-windows-lpe-poc.png?v=094f333761",{"cves":18,"malware":27,"technologies":30},[19],{"id":13,"kev":20,"poc":20,"url":21,"cvss":22,"epss":23,"risk_band":24,"risk_score":25,"cvss_version":26},false,"\u002Fvulnerabilities\u002FCVE-2026-62832",7.8,0.0037,"Medium",45.42,"3.1",[28],{"name":29},"ShieldBreak",[31],{"vendor":32,"product":33},"Microsoft","Windows Defender","threat_actor_activity","2026-08-28T07:20:29.116004+00:00","2026-10-16T12:29:10.601235+00:00",null,{"articles":39},[40,47,59,72],{"slug":41,"title":42,"summary":43,"tags":44,"hero_image_url":45,"story_type":34,"created_at":46},"nightmare-eclipse-releases-shieldbreak-windows-lpe-poc-for-cve-2026-62832","Nightmare-Eclipse releases ShieldBreak Windows LPE PoC for CVE-2026-62832","The Nightmare-Eclipse actor published ShieldBreak, its tenth Windows LPE PoC, which abuses Cloud Files, Object Manager namespace, Defender API, and a remediation timing race to load a DLL from System32 and execute as SYSTEM.",[10,11,13,14,12],"https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fnightmare-eclipse-releases-shieldbreak-windows-lpe-poc-for-cve-2026-62832.png?v=ad2aa48da3","2026-09-18T12:04:47.546492+00:00",{"slug":48,"title":49,"summary":50,"tags":51,"hero_image_url":56,"story_type":57,"created_at":58},"sophos-mdr-accelerates-netntlmv1-rainbow-table-lookups-without-gpus","Sophos MDR Accelerates NetNTLMv1 Rainbow Table Lookups Without GPUs","Sophos MDR research shows that NetNTLMv1 rainbow table lookups can be accelerated without GPU acceleration, reducing the cost and complexity of exploiting the legacy protocol in modern Windows environments.",[52,53,54,10,55],"NetNTLMv1","Rainbow Table","Sophos MDR","Credential Attack","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fsophos-mdr-accelerates-netntlmv1-rainbow-table-lookups-without-gpus.png?v=4ba5ea1c64","vulnerability_disclosure","2026-09-13T07:05:38.508154+00:00",{"slug":60,"title":61,"summary":62,"tags":63,"hero_image_url":70,"story_type":34,"created_at":71},"russian-state-actors-exploit-exposed-ip-cameras-to-track-nato-troop-movements-in","Russian State Actors Exploit Exposed IP Cameras to Track NATO Troop Movements in Ukraine","The Netherlands' AIVD and MIVD released a joint advisory warning that Russian state actors are systematically exploiting publicly exposed IP cameras to track NATO troop and supply movements in the ongoing Ukraine war.",[64,65,66,67,68,69],"Russia","IP Camera","NATO","Ukraine","AIVD","MIVD","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Frussian-state-actors-exploit-exposed-ip-cameras-to-track-nato-troop-movements-in.png?v=74b95987f5","2026-09-30T07:07:04.966623+00:00",{"slug":73,"title":74,"summary":75,"tags":76,"hero_image_url":83,"story_type":34,"created_at":84},"fancy-bear-ai-enabled-attacks-surge-89-in-crowdstrike-2026-report","Fancy Bear AI-Enabled Attacks Surge 89% in CrowdStrike 2026 Report","CrowdStrike's 2026 Global Threat Report shows Fancy Bear (APT28) AI-enabled adversary activity up 89% year-over-year, eCrime average breakout time at 29 minutes, and GenAI prompt injection confirmed at 90+ organizations.",[77,78,79,80,81,82],"Fancy Bear","APT28","CrowdStrike","LLM malware","GenAI prompt injection","eCrime","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Ffancy-bear-ai-enabled-attacks-surge-89-in-crowdstrike-2026-report.png?v=f7ed8c119c","2026-09-29T12:06:38.382267+00:00"]