CVE-2026-62832: Microsoft Patches "LegacyHive" Windows Zero-Day

Summary

Vulnerability Details

Root Cause Analysis

CVE-2026-62832 lives in the Windows User Profile Service, the component responsible for loading and unloading a user's registry hive (NTUSER.DAT) when they log on or off a system. The flaw is a classic link-following issue, CWE-59: the service resolves a file path used during hive loading without adequately verifying that the path has not been redirected via a symbolic link, junction, or similar filesystem object before it is accessed.

Because that resolution step trusts the path rather than validating where it actually points, an authenticated attacker who holds credentials for a second local account can plant a redirect that causes the service to load or write to a hive location it should not touch, specifically another user's profile hive. Vulnerability analyst Will Dormann explained that a non-admin user can abuse this behavior to modify the target user's classes registry hive so that it gains automatic code execution the next time that user, potentially an administrator, logs in, turning a local logon event into a privilege escalation trigger. Successful exploitation requires no user interaction from the victim beyond a normal, expected logon.

Microsoft has not published the deeper internals of the flawed resolution logic, consistent with its standard practice of withholding exploit-enabling detail from public advisories, and has stated only that it is "aware of the reported vulnerability" without initially confirming the researcher's claims.

How CVE-2026-62832 Can Be Exploited

Attack prerequisites

1. 1. Local access to a Windows system running an affected, unpatched build.
2. 2. Valid credentials for a second local account on the same system, distinct from the attacker's primary low-privileged account.
3. 3. The ability to run a specially crafted application under the attacker's own account; no interaction from the targeted (higher-privileged) user is required beyond their normal logon.

Conceptual exploitation flow

1. 1. The attacker, already authenticated as a low-privileged local user, obtains or already holds credentials for a second local account on the same machine.
2. 2. The attacker runs a specially crafted application that abuses the Windows User Profile Service's improper link resolution, redirecting the hive-loading path toward the target user's registry hive rather than the attacker's own.
3. 3. As described by vulnerability analyst Will Dormann, the attacker uses this redirection to modify the target user's classes registry hive, planting entries designed to execute automatically on that user's next logon.
4. 4. When the higher-privileged, potentially administrator, account subsequently logs in, the planted registry entries execute in that user's context, without any additional action or awareness on their part.
5. 5. The attacker's code now runs with administrator privileges, completing the escalation from a low-privileged local foothold to full administrative control of the system.

Impact

MITRE ATT&CK Mapping

Mitigation

1. 1. Apply Microsoft's August 2026 Patch Tuesday update for CVE-2026-62832 immediately.
2. 2. Deploy the free unofficial 0Patch micropatch from ACROS Security as an interim measure on systems that cannot be patched right away, available for Windows 10 2004+ and Windows Server 2022+.
3. 3. Deploy Kevin Beaumont's published KQL detection queries in Microsoft Defender for Endpoint to hunt for LegacyHive exploitation attempts.
4. 4. Audit and tighten use of secondary local accounts on shared workstations, terminal servers, and VDI hosts, where this flaw is most practically exploitable.
5. 5. Monitor registry hive load and classes-hive modification events tied to the Windows User Profile Service for signs of tampering.
6. 6. Prioritize patch rollout on multi-user and privileged-access systems where an administrator account regularly logs on alongside lower-privileged users.

Instantly Fix Risks with Saner Patch Management