New Windows LegacyHive zero-day gives hackers admin privileges

A security researcher known as "Nightmare Eclipse" released a proof-of-concept called LegacyHive that exploits a previously unassigned Windows User Profile Service vulnerability to escalate privileges on up-to-date Windows systems by mounting and modifying user registry hives (usrclass.dat), enabling automatic code execution when an administrator logs in; the PoC was intentionally modified to require additional credentials, independent researchers confirmed the exploit and published detection guidance for Microsoft Defender for Endpoint, and Microsoft has warned of legal action related to such disclosures.