A Windows zero-day vulnerability known as 'LegacyHive' was disclosed after the July 2026 Patch Tuesday, affecting the Windows User Profile Service. The flaw allows an authenticated attacker to gain administrator privileges via improper link resolution before file access in the service, enabling them to access or modify another user's data and gain elevated privileges without requiring user interaction. This vulnerability has been assigned CVE-2026-62832 with a CVSS score of 9.8, indicating a critical flaw type that can be exploited through local attack vectors. The business impact is significant, as successful exploitation could lead to unauthorized access to sensitive data and compromise system security.
We recommend you to apply the August 2026 Microsoft security updates[/subscribe_to_unlock_form]
A Windows zero-day vulnerability known as 'LegacyHive' was disclosed after the July 2026 Patch Tuesday, affecting the Windows User Profile Service. The flaw allows an authenticated attacker to gain administrator privileges via improper link resolution before file access in the service, enabling them to access or modify another user's data and gain elevated privileges without requiring user interaction. This vulnerability has been assigned CVE-2026-62832 with a CVSS score of 9.8, indicating a critical flaw type that can be exploited through local attack vectors. The business impact is significant, as successful exploitation could lead to unauthorized access to sensitive data and compromise system security.
We recommend you to apply the August 2026 Microsoft security updates[emaillocker id="1283"]
The following reports contain further technical details:
[/emaillocker]