Microsoft recently patched a zero-day vulnerability known as LegacyHive that affected the Windows User Profile Service.

Through this blog, we will understand what the recently patched LegacyHive zero-day vulnerability is about, the threat it poses, and what organizations must do to defend against it.

About LegacyHive

Potentially affected environments

Environments where unprivileged users have local access to Windows systems. These include:

• Shared workstations
• Multi-user environments
• Terminal servers

The threat posed by the vulnerability

An authenticated attacker could use a specially crafted application to exploit the flaw causing Windows User Profile Service to load another user’s registry hive. A successful exploitation requires local authenticated access.

By exploiting the vulnerability, an attacker can:

• Access or modify another user’s Windows profile data.
• Load and manipulate another user’s registry hive.
• Abuse symbolic-link or link-resolution behavior within the Windows User Profile Service.
• Escalate privileges from a local authenticated account to Administrator.
• Potentially gain elevated control over an affected Windows endpoint.
• Use elevated privileges to execute additional malicious activity or establish persistence.
• Compromise systems where attackers already have a local foothold.

Official mitigation guide

Organizations should:

• Apply the applicable August 11, 2026 Microsoft security updates to all affected Windows systems.
• Use Microsoft Defender Vulnerability Management to identify vulnerable endpoints.
• Reboot affected systems after installing the security update unless an applicable hotpatch has been deployed.
• Ensure Microsoft Defender Antivirus real-time protection is enabled.
• Enable cloud-delivered protection in Microsoft Defender Antivirus.
• Enable EDR in block mode where applicable.
• Configure Microsoft Defender for Endpoint automated investigation and remediation where appropriate.
• Restrict unnecessary local user and administrative access.
• Prioritize shared, multi-user, and terminal-server environments where local privilege escalation could have greater impact.

Affected Build Examples:

• Windows 10 Version 21H2: Before 10.0.19044.7663
• Windows 10 Version 22H2: Before 10.0.19045.7663
• Windows 11 Version 23H2: Before 10.0.22631.7517
• Windows 11 Version 24H2: Before 10.0.26100.9168
• Windows 11 Version 25H2: Before 10.0.26200.9168
• Windows 11 Version 26H1: Before 10.0.28000.2704
• Windows Server 2022: Before 10.0.20348.5499
• Windows Server 2025: Before 10.0.26100.33296

Hotpatch-specific build requirements should be validated against Microsoft’s official security update guidance.

SharkStriker’s recommendations

• Prioritize CVE-2026-62832 because of its potential to enable local privilege escalation.
• Maintain an accurate inventory of Windows desktop and server systems.
• Identify systems running builds below Microsoft’s August 2026 security-update levels.
• Apply the applicable Microsoft security updates as soon as possible.
• Prioritize shared workstations, terminal servers, and other multi-user systems.
• Restrict unnecessary local account access and administrative privileges.
• Ensure Microsoft Defender Antivirus and EDR protections are enabled.
• Validate patch compliance after deployment.

SharkStriker’s actions

• Threat intelligence profile reviewed.
• CVE-2026-62832 assessed for severity and customer relevance.
• Windows User Profile Service identified as the affected component.
• Local privilege escalation identified as the primary security impact.
• Microsoft security update released on August 11, 2026, identified as the primary remediation.
• Microsoft Defender Vulnerability Management exposure tracking identified for affected endpoints.
• Customers operating affected Windows versions advised to prioritize remediation.