Free unofficial patches are available for a recently disclosed Windows zero-day flaw that allows attackers to escalate privileges on up-to-date Windows systems.

The vulnerability (dubbed LegacyHive and without a CVE ID for easy tracking) was found by a security researcher using the “Nightmare Eclipse” handle in the Windows User Profile Service.

Nightmare Eclipse disclosed it the day Microsoft released its July 2026 Patch Tuesday updates, together with a stripped proof-of-concept exploit designed to make it harder for threat actors to weaponize this security issue in attacks.