CVE-2026-62832 is a high-severity local privilege escalation vulnerability in the Microsoft Windows User Profile Service. The flaw allows an authenticated, low-privileged attacker to abuse improper link resolution during profile hive loading and potentially access or modify another user’s registry data, ultimately gaining administrator privileges.
Microsoft formally disclosed and patched CVE-2026-62832 on August 11, 2026, assigning it a CVSS 3.1 base score of 7.8 High. The vulnerability is categorized as CWE-59: Improper Link Resolution Before File Access, commonly called a link-following weakness. Its CVSS vector is AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H: exploitation requires local access and low privileges, but has low attack complexity, requires no victim interaction, and can produce high confidentiality, integrity, and availability impact. (NVD)
What makes CVE-2026-62832 more interesting than an ordinary Patch Tuesday local privilege escalation is its disclosure history. The underlying vulnerability had already become public in July 2026 under the name LegacyHive, when security researcher Nightmare-Eclipse released proof-of-concept code targeting the Windows User Profile Service. ACROS Security’s 0patch team subsequently analyzed the issue and shipped a micropatch before Microsoft issued its official fix. When Microsoft released its August security update, 0patch updated its analysis to state that LegacyHive had been assigned CVE-2026-62832 and that Microsoft’s final patch was logically equivalent to the mitigation it had independently developed. (0patch – Better Security Patches)
This distinction matters for defenders. CVE-2026-62832 was not a vulnerability disclosed privately and quietly fixed before technical information became available. Attackers had weeks to study the underlying primitive before the official Microsoft patch arrived.
At the same time, it is important not to exaggerate the threat. As of August 26, 2026, Microsoft has not identified CVE-2026-62832 as exploited in the wild, and CISA’s enrichment data records exploitation as “none.” Zero Day Initiative similarly lists the vulnerability as publicly disclosed but not exploited. That is different from the actively exploited CVE-2026-68820 that Microsoft also fixed during August Patch Tuesday. (NVD)
So CVE-2026-62832 should be understood as a publicly documented, practical post-compromise privilege-escalation primitive, not as an unauthenticated remote-code-execution vulnerability.
CVE-2026-62832 at a Glance
| Atributo | CVE-2026-62832 |
|---|---|
| CVE | CVE-2026-62832 |
| Componente | Windows User Profile Service |
| Tipo de vulnerabilidade | Elevação de privilégio |
| Fraqueza | CWE-59 Improper Link Resolution Before File Access |
| CVSS 3.1 | 7.8 High |
| Vetor de ataque | Local |
| Attack complexity | Baixa |
| Privileges required | Baixa |
| User interaction | Nenhum |
| Confidentiality impact | Alta |
| Integrity impact | Alta |
| Availability impact | Alta |
| Publicly disclosed | Sim |
| PoC pública | Yes, LegacyHive |
| Confirmed exploitation in the wild | No confirmed exploitation as of August 26, 2026 |
| Microsoft patch | August 11, 2026 |
Microsoft’s CNA description is concise: improper link resolution before file access in Windows User Profile Service allows an authorized attacker to elevate privileges locally. Microsoft’s published affected-product data covers Windows 10, several generations of Windows 11, Windows Server 2022, and Windows Server 2025. (NVD)
The short description, however, hides a particularly interesting Windows security boundary problem involving registry hives, SYSTEM-level profile management, symbolic-link redirection, and a time-of-check-to-time-of-use condition.
What Is the Windows User Profile Service?
Windows users normally think of a “profile” as the directory under:
C:\Users\<username>\
But a Windows profile consists of more than ordinary files.
Microsoft documents that each user receives a registry hive containing settings specific to that user’s applications, desktop, environment, network connections, printers, and other configuration. The system loads the user’s registry hive when the user logs on. User profile hives ultimately appear beneath HKEY_USERS, while the currently logged-in user’s hive is exposed through familiar registry locations such as HKEY_CURRENT_USER. (Microsoft Learn)
Two files are particularly relevant when discussing Windows profiles:
C:\Users\<user>\NTUSER.DAT
and:
C:\Users\<user>\AppData\Local\Microsoft\Windows\UsrClass.dat
NTUSER.DAT stores much of the user’s main registry configuration.
UsrClass.dat contains the per-user classes registry data associated with areas such as shell behavior, file associations and COM registrations.
The important security property is isolation.
Alice should not be able to obtain unrestricted write access to Bob’s registry hive merely because both users have accounts on the same Windows machine.
That boundary becomes particularly significant when Bob is an administrator.
The Windows User Profile Service, often referred to as ProfSvc, needs substantially more authority than a normal user to manage these profiles. Profile operations are performed by privileged Windows infrastructure because the operating system must be able to load hives, unload them, manage roaming or mandatory profiles and perform operations across different account contexts.
Microsoft’s LoadUserProfile documentation illustrates the sensitivity of this operation. A successfully loaded profile produces a handle to the user’s registry hive, and Microsoft notes that the returned hive handle is opened with KEY_ALL_ACCESS. Calling profile-management APIs also involves privileged capabilities unavailable to an ordinary application. (Microsoft Learn)
CVE-2026-62832 turns this privileged profile-management capability into an attack surface.
Why Registry Hive Loading Is a Security Boundary
Imagine a simplified profile-loading operation.
The operating system receives a request to load:
C:\Users\Alice\AppData\Local\Microsoft\Windows\UsrClass.dat
Before performing a privileged operation, Windows needs to establish whether the caller is allowed to access the requested file.
Conceptually, code may behave like this:
1. Determine the hive path.
2. Check whether the requesting user can access that file.
3. Decide which security context should perform the load.
4. Open and load the hive.
At first glance this is sensible.
The security problem arises if the object checked in step 2 is not guaranteed to remain the same object accessed in step 4.
Suppose Windows checks:
C:\TemporaryLocation\safe.dat
but an attacker can alter path resolution before the privileged access takes place.
The resulting operation might effectively become:
CHECK:
C:\TemporaryLocation\safe.dat
USE:
C:\Users\Admin\AppData\Local\Microsoft\Windows\UsrClass.dat
A privileged process has now validated one resource but acted on another.
That is the essence of the class of security problem involved in CVE-2026-62832.
CVE-2026-62832 and CWE-59
Microsoft classifies CVE-2026-62832 as CWE-59: Improper Link Resolution Before File Access.
MITRE defines this weakness as software accessing a file based on a filename without properly preventing that filename from identifying a link or shortcut resolving to an unintended resource. The consequences commonly include unauthorized reads and modifications. (cwe.mitre.org)
The vulnerability therefore should not be understood as memory corruption.
There is no requirement to overflow a kernel buffer, corrupt a function pointer, defeat Control Flow Guard or construct a ROP chain.
Instead, the attack targets object identity and path resolution.
A useful conceptual representation looks like this:
Low-Privilege User
|
v
Attacker-Controlled Path
|
v
Windows checks object A
|
| path/object redirection
v
Privileged operation reaches object B
|
v
Another User's Registry Hive
This class of vulnerability can be extremely powerful precisely because the privileged service itself performs the sensitive operation.
The attacker does not necessarily need permission to directly open the protected resource.
The attacker needs to persuade a more privileged component to open it.
The LegacyHive Connection
Before Microsoft assigned CVE-2026-62832, the vulnerability was publicly known as LegacyHive.
A proof of concept appeared in July 2026. Government and security-industry alerts soon began warning that the Windows User Profile Service weakness could enable privilege escalation. Hong Kong’s Government Computer Emergency Response Team, for example, issued an alert on July 16 referencing the public LegacyHive PoC. (govcert.gov.hk)
The released proof of concept was intentionally constrained.
Contemporary reporting quoted the researcher as saying that the public PoC required credentials for another standard account and the username of a third account, with the target potentially being an administrator. If successful, it could cause the target user’s hive to become mounted into the attacker’s current-user classes registry context. The researcher also said the original internal technique was less restricted than the released version and was not limited to UsrClass.dat. (Notícias do Hacker)
That distinction is important when evaluating exploitability.
A public proof of concept represents what defenders and attackers can immediately study.
It does not necessarily represent the theoretical maximum capability of the underlying vulnerability.
How CVE-2026-62832 Works
Microsoft’s public CVE description intentionally stays at a high level. More detailed technical understanding comes from analysis of the LegacyHive technique performed before and after the CVE assignment.
0patch’s analysis describes a TOCTOU weakness in Windows User Profile Service’s registry-hive loading logic.
According to its research, Windows determines whether the requesting user has full access to the hive file. Depending on the result, the service follows different hive-loading paths. The crucial security error was that one path could ultimately perform the hive load under Local System authority.
The attacker could deliberately cause the access check to fail against a temporary controlled file and then change the path resolution before the privileged hive-loading operation occurred.
The sequence can be simplified to:
Attacker starts profile-loading sequence
|
v
ProfSvc evaluates controlled DAT file
|
v
Access check fails
|
v
Privileged load path selected
|
attacker changes
path resolution
|
v
Path resolves to victim UsrClass.dat
|
v
Victim hive loaded into attacker's
registry namespace with powerful access
0patch reports that the race was achieved using symbolic-link redirection between the access check and the subsequent hive load. The result was the target user’s USRCLASS.DAT being mounted into the attacker’s registry space with read/write access. (0patch – Better Security Patches)
This is why describing CVE-2026-62832 merely as a “symlink bug” understates the issue.
The actual security failure involves the interaction of several conditions:
A privileged service handles user-controlled or influenceable paths.
Permission checking and resource use are separated in time.
Path resolution can change between those operations.
A fallback code path may perform the final action using SYSTEM authority.
Each piece by itself can be legitimate.
Together, they create an elevation-of-privilege primitive.
The TOCTOU Problem
TOCTOU stands for Time of Check to Time of Use.
It describes situations in which software validates a condition and then later relies on the assumption that the condition remains unchanged.
Consider:
if user_can_modify(file):
open(file)
Se arquivo always represents precisely the same underlying object, the logic may be safe.
But suppose another thread or process can change what the path represents between the two operations:
T1: Security check -> harmless.dat
T2: Attacker changes link
T3: Privileged open -> administrator-secret.dat
Then the result of the original check is no longer relevant.
Windows introduces additional complexity because path resolution can involve NT Object Manager objects, reparse points, symbolic links and multiple namespace layers.
A path string is not necessarily synonymous with a permanently identified file object.
Secure privileged software therefore must ensure that it performs authorization against the same resource on which it eventually acts.
CVE-2026-62832 violated that principle.
Why Symbolic Links Matter
A symbolic link creates an indirection between one path and another destination.
A simplified example looks like:
C:\Temp\ProfileHive.dat
|
+----> C:\Users\Admin\...\UsrClass.dat
If an application resolves the link only at the moment it opens the file, changing where that link points can alter the effective target.
The vulnerability becomes especially dangerous when the process doing the opening operates as SYSTEM.
An attacker may not be allowed to open:
C:\Users\Admin\...\UsrClass.dat
directly.
But SYSTEM can.
The objective therefore becomes:
Attacker cannot access protected target
|
v
Influence request supplied to SYSTEM service
|
v
SYSTEM service accesses target
This pattern appears repeatedly in local Windows privilege-escalation research.
The vulnerable privileged service becomes a confused deputy.
The ProfSvc Decision Problem
0patch’s reverse-engineering provides an especially useful explanation of the underlying logic.
According to the researchers, the vulnerable User Profile Service effectively behaved differently depending on whether the user could obtain full access to the hive file.
If full access was available, a newer hive-loading mechanism supporting impersonation could operate using the requesting user’s security context.
If full access was not available, the service could instead follow an older privileged loading path operating as Local System.
The paradox was obvious in retrospect:
User has permission:
load using user's authority
User does not have permission:
load using SYSTEM authority
That fallback behavior existed for legitimate compatibility reasons, particularly scenarios involving read-only profiles.
Microsoft documents mandatory user profiles, for example, in which an administrator renames NTUSER.DAT para NTUSER.MAN, making the profile effectively read-only to the user. (Microsoft Learn)
Compatibility code therefore had to accommodate profile hives that a user could not write normally.
But a security-sensitive fallback created a dangerous condition when combined with path manipulation.
The attack could intentionally cause the first access check to fail and thereby steer the code toward the privileged branch.
The symbolic-link race then changed the object being loaded.
What Does Successful Exploitation Give the Attacker?
The immediate primitive demonstrated by LegacyHive is cross-user registry hive access.
This should not automatically be translated into “instant SYSTEM shell.”
The distinction matters.
The public PoC demonstrated the ability to place another user’s registry hive into a context accessible by the attacker.
That can expose two broad classes of opportunity.
Reading sensitive registry information
Windows applications frequently store per-user information in the registry.
Depending on the software installed and the target account, registry information may contain:
- application settings;
- paths;
- authentication metadata;
- remembered configuration;
- account-specific secrets or tokens;
- software integration information;
- COM configuration;
- shell configuration.
0patch specifically warned that attackers could potentially extract stored secrets from a victim’s registry hive. (0patch – Better Security Patches)
The actual value of the data depends heavily on the target system.
A local administrator’s hive on a developer workstation, jump host or server-management workstation may be far more valuable than an ordinary kiosk account.
Modifying privileged-user configuration
Write access is potentially more dangerous than read access.
Many Windows mechanisms ultimately consume registry-controlled values when users log on or launch applications.
An attacker capable of modifying another user’s configuration may be able to influence what executable, DLL, COM object or shell extension is loaded when the victim later performs some action.
0patch noted that an attacker could replace references to trusted executables or DLLs with malicious alternatives so that attacker-controlled code would execute when the target subsequently logs on. (0patch – Better Security Patches)
If that target is an administrator, this creates a bridge from:
Low-Privilege Attacker
|
v
Modify Administrator Hive
|
v
Administrator Logs On
|
v
Attacker-Controlled Code Runs
|
v
Administrator-Level Execution
This explains why Microsoft classifies the impact as elevation of privilege even though the immediate vulnerability involves registry hive manipulation rather than direct token stealing.
Attack Preconditions
CVE-2026-62832 is a local vulnerability.
The CVSS vector explicitly identifies:
AV:L
An attacker cannot simply scan a public IP address and send a network packet to ProfSvc.
They first need a presence on the Windows system.
Microsoft’s reported attack scenario requires an authenticated attacker. Public reporting around Microsoft’s advisory states that an attacker with credentials for another local account could execute a specially crafted application to load another user’s registry hive, potentially accessing or modifying that user’s data and eventually gaining administrator privileges. No victim interaction is required. (Notícias do Hacker)
The public LegacyHive PoC imposed additional restrictions.
It required:
Existing standard-user code execution
+
Credentials for another standard user
+
Target username
Those restrictions make the public PoC less convenient than many conventional local privilege-escalation exploits.
But organizations should avoid treating them as permanent security guarantees.
The researcher explicitly described the public release as intentionally reduced, and independent analyses noted that the unreleased version was reportedly less constrained. (Notícias do Hacker)
More importantly, attackers operating inside corporate networks frequently possess multiple credentials.
Credential reuse, browser sessions, help-desk accounts, compromised domain accounts, service credentials and previously harvested passwords can all create environments where “credentials for another account” is not an unusual requirement.
CVE-2026-62832 Is a Post-Exploitation Vulnerability
The most realistic place for CVE-2026-62832 is not the beginning of an intrusion.
It is the middle.
Consider an intrusion chain:
Phishing / Malicious Attachment / Stolen VPN Credential
|
v
User-Level Foothold
|
v
CVE-2026-62832
|
v
Administrator Privileges
|
v
Credential Theft / Persistence
|
v
Lateral Movement / Domain Impact
This is why local elevation-of-privilege bugs should not be dismissed merely because they require authentication.
Attackers routinely separate initial access from privilege escalation.
The vulnerability providing the foothold and the vulnerability providing administrative control may be completely different bugs.
In a ransomware intrusion, for example, the attacker does not necessarily care whether CVE-2026-62832 can be reached from the Internet.
They care whether it can convert malware running under an ordinary employee account into administrative control over the endpoint.
Why the CVSS Score Is 7.8
The CVSS vector provides a useful model of the risk:
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack Vector: Local
AV:L
The attacker needs local execution or equivalent authenticated access.
This prevents the score from reaching the range typical of unauthenticated Internet-facing RCE vulnerabilities.
Attack Complexity: Low
AC:L
Microsoft’s score does not assign high attack complexity.
That is significant given the presence of a race condition.
The existence of TOCTOU behavior does not automatically mean CVSS considers exploitation unreliable enough to warrant AC:H.
Privileges Required: Low
PR:L
The vulnerability starts with an attacker already possessing a low-privilege account.
Administrative access is not required.
User Interaction: None
UI:N
The victim does not need to open a malicious file, accept a UAC prompt or click an attacker-controlled link for the vulnerability itself to trigger.
High Confidentiality, Integrity and Availability Impact
C:H/I:H/A:H
Successful privilege escalation can destroy the security guarantees provided by the original low-privilege sandbox.
Once an attacker reaches administrative control, the effective impact can extend far beyond profile configuration.
Microsoft therefore scores the vulnerability 7.8 High. (NVD)
Which Windows Versions Are Affected?
Microsoft’s CVE record identifies the following affected product families:
| Produto | Vulnerable builds | Patched threshold |
|---|---|---|
| Windows 10 Version 21H2 | 10.0.19044.0 to below 10.0.19044.7663 | 19044.7663 or later |
| Windows 10 Version 22H2 | 10.0.19045.0 to below 10.0.19045.7663 | 19045.7663 or later |
| Windows 11 Version 23H2 | 10.0.22631.0 to below 10.0.22631.7517 | 22631.7517 or later |
| Windows 11 Version 24H2 | 10.0.26100.0 to below 10.0.26100.9168 | 26100.9168 or later |
| Windows 11 Version 25H2 | 10.0.26200.0 to below 10.0.26200.9168 | 26200.9168 or later |
| Windows 11 Version 26H1 | 10.0.28000.0 to below 10.0.28000.2704 | 28000.2704 or later |
| Windows Server 2022 | 10.0.20348.0 to below 10.0.20348.5499 | 20348.5499 or later |
| Windows Server 2025 | 10.0.26100.0 to below 10.0.26100.33296 | 26100.33296 or later |
| Windows Server 2025 Server Core | 10.0.26100.0 to below 10.0.26100.33296 | 26100.33296 or later |
These ranges come directly from the Microsoft CNA data reproduced by NVD. (NVD)
Administrators should still use Microsoft Update, Windows Update for Business, WSUS, Intune or their enterprise patch-management platform rather than treating the build table as a substitute for Microsoft’s servicing guidance.
The practical rule is simple:
Systems should have the August 11, 2026 Windows security updates or a later cumulative update that supersedes them.
How to Check Whether a Windows Host Is Vulnerable
A quick first step is checking the operating-system build.
From PowerShell:
Get-ComputerInfo |
Select-Object WindowsProductName, WindowsVersion, OsBuildNumber
You can also retrieve version information using:
[System.Environment]::OSVersion.Version
Or:
Get-CimInstance Win32_OperatingSystem |
Select-Object Caption, Version, BuildNumber
Exemplo:
Caption : Microsoft Windows 11 Pro
Version : 10.0.26100
BuildNumber : 26100
Be careful: the base build alone may not expose the full update revision required to distinguish something like:
26100.9000
de:
26100.9168
For a more precise view:
Get-ItemProperty `
'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion' |
Select-Object ProductName, DisplayVersion, CurrentBuild, UBR
The effective build can be constructed from:
CurrentBuild.UBR
Por exemplo:
CurrentBuild = 26100
UBR = 9168
Result:
26100.9168
This makes comparison against the CVE’s patched build ranges straightforward.
A basic defensive inventory script could look like:
$os = Get-ItemProperty `
'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion'
[PSCustomObject]@{
Product = $os.ProductName
DisplayVersion = $os.DisplayVersion
Build = "$($os.CurrentBuild).$($os.UBR)"
}
This does not exploit or probe the vulnerability. It simply gives administrators the information required to compare host builds with Microsoft’s patched versions.
Why Windows Server and Multi-User Systems Deserve Special Attention
CVE-2026-62832 is particularly relevant to systems where multiple security principals regularly interact with the same operating-system instance.
Os exemplos incluem:
Remote Desktop Session Hosts
VDI endpoints
shared administrative servers
developer jump boxes
lab environments
multi-user workstations
build servers
Windows application servers
training environments
support desktops
On a single-user laptop where one employee is effectively the only interactive user, obtaining credentials for another meaningful local account may be more difficult.
On an RDS host serving dozens of users, the security boundary being attacked is much more central to the system’s purpose.
The same is true for shared administration infrastructure.
If several privileged and nonprivileged accounts use the same Windows host, cross-user access to profile registry data becomes substantially more valuable.
The vulnerability therefore has a risk profile that depends heavily on host role, not just CVSS.
LegacyHive Was Public Before Microsoft’s Patch
The disclosure timeline deserves attention.
The LegacyHive PoC was published in mid-July 2026. At that point the July Windows security updates did not address the technique. 0patch published its own micropatch shortly afterward. Microsoft subsequently included an official fix in the August 11 security release and associated the vulnerability with CVE-2026-62832. (0patch – Better Security Patches)
A simplified timeline is:
| Date | Event |
|---|---|
| July 14–15, 2026 | LegacyHive proof of concept becomes public |
| July 16, 2026 | Government and security-industry alerts appear |
| July 20, 2026 | 0patch publishes detailed analysis and micropatch |
| August 11, 2026 | Microsoft patches the vulnerability and publishes CVE-2026-62832 |
| August 2026 | Microsoft categorizes the issue as Windows User Profile Service Elevation of Privilege |
0patch says its users received protection 23 days before Microsoft’s official patch became available. (0patch – Better Security Patches)
From a vulnerability-management perspective, this means defenders should not treat CVE publication date as vulnerability discovery date.
Technical exploitation knowledge existed significantly earlier.
Is CVE-2026-62832 a Zero-Day?
The word “zero-day” creates confusion because it is often used to mean several things.
One meaning is:
A vulnerability was publicly known before the vendor issued a fix.
Under that definition, LegacyHive was clearly a zero-day during July 2026.
A different, stronger meaning is:
Attackers are actively exploiting the vulnerability in real intrusions.
There is currently no public evidence establishing that CVE-2026-62832 was actively exploited before Microsoft’s patch.
Microsoft’s August release marked it as publicly disclosed, while security summaries categorize it separately from CVE-2026-68820, which was actually observed under exploitation. (Zero Day Initiative)
That distinction should remain explicit in vulnerability reports.
Accurate wording would be:
CVE-2026-62832 was a publicly disclosed Windows zero-day with available proof-of-concept research before Microsoft released its patch, but there is no confirmed evidence of exploitation in the wild as of August 26, 2026.
Is a Public Exploit Available?
Yes, but the wording again matters.
O LegacyHive proof of concept was publicly available before CVE-2026-62832 was assigned.
It demonstrates the underlying Windows User Profile Service weakness.
The public code was intentionally constrained by its researcher and should not be equated automatically with a polished commodity privilege-escalation module.
Still, public source code dramatically reduces the research barrier.
Attackers do not need to independently discover the flaw from scratch.
They can examine:
the triggering sequence
the profile-loading behavior
relevant Windows APIs
required timing
registry layout
symbolic-link behavior
service interactions
and develop their own variations.
That alone increases defensive urgency.
Why “No Active Exploitation” Does Not Mean “Low Risk”
Vulnerability management often over-optimizes around one field:
Known Exploited: Yes / No
That field matters enormously.
But it is not the whole risk model.
CVE-2026-62832 combines several characteristics defenders should notice:
Publicly disclosed before patch
+
Public PoC
+
Windows security boundary
+
Low privileges required
+
Low attack complexity
+
No victim interaction
+
Administrative impact
CISA’s vulnerability enrichment rates its technical impact as total, even though exploitation was recorded as none. (NVD)
For an attacker who already has a foothold, a reliable Windows privilege escalation primitive can be extremely useful.
That makes CVE-2026-62832 a strong example of why “not remotely exploitable” should never be translated into “not important.”
Detecting CVE-2026-62832 Exploitation
Patching is the primary defense.
Detection remains valuable for three reasons.
First, not every device will be patched immediately.
Second, organizations may need to determine whether exploitation occurred before the patch was deployed.
Third, behavioral detections for cross-user registry-hive manipulation can uncover related techniques even when the exact exploit implementation changes.
Defenders should focus less on a single exploit filename and more on the unusual behavior required by the attack.
Detection Signal 1: Cross-User Hive Access
The strongest conceptual indicator is one user’s process or profile-loading activity interacting unexpectedly with another user’s registry hive.
Relevant files include:
C:\Users\<victim>\NTUSER.DAT
and:
C:\Users\<victim>\AppData\Local\Microsoft\Windows\UsrClass.dat
Defenders should ask:
Which process accessed the hive?
Which user owned the process?
Which user owns the hive?
Was the target user logged on?
Was this an expected profile-management operation?
A mismatch does not automatically prove exploitation.
Backup software, endpoint-management agents, forensic tools and legitimate administrative utilities can read user-profile data.
But a low-privileged interactive process participating in access to another privileged user’s hive deserves investigation.
Detection Signal 2: Unexpected Hive Mounts
Windows loads user hives beneath registry namespaces associated with user SIDs.
Defenders can look for anomalous relationships such as:
low-privilege user context
+
another user's hive
+
unexpected *_Classes mount
The key is correlation.
A Classes hive existing is normal.
A classes hive whose source file belongs to an unrelated user and whose loading activity coincides with unusual low-privileged process execution is not.
Windows itself documents how profile hives are loaded under HKEY_USERS, making registry-hive identity useful forensic context. (Microsoft Learn)
Detection Signal 3: Symbolic-Link and Object Redirection Activity
LegacyHive relies on manipulating path resolution.
Depending on available telemetry, defenders may want to correlate:
temporary directory creation
DAT file creation
unusual symbolic-link behavior
rapid rename/delete/replacement operations
profile-loading events
access to UsrClass.dat
unexpected registry hive mounts
No single event is necessarily malicious.
The sequence is more important than an individual indicator.
Behavioral correlation is therefore preferable to a signature matching a particular PoC executable.
Detection Signal 4: Suspicious Profile Loading
Windows profile loading creates characteristic behavior involving User Profile Service.
Investigators should establish normal patterns for:
interactive logons
RunAs activity
service-account profile loads
RDP logons
scheduled tasks
administrative tooling
and then identify profile loads that appear disconnected from normal authentication activity.
Microsoft’s LoadUserProfile documentation confirms that applications and services can explicitly load another user’s profile when they operate under the appropriate credentials and privileges. (Microsoft Learn)
Therefore, simply observing a profile load is not enough.
The goal is to identify unexpected cross-user profile loading initiated around suspicious user activity.
Detection Signal 5: Registry Persistence Following Hive Manipulation
The privilege escalation often becomes valuable when an attacker can modify settings that a privileged user will later consume.
Therefore, defenders should investigate suspicious modifications to registry areas associated with execution or persistence after unusual cross-user hive access.
Examples worth monitoring include unexpected changes involving:
COM registrations
shell extensions
file associations
startup configuration
application execution paths
per-user software configuration
This should be implemented carefully.
Enterprise applications legitimately change many of these values.
A high-quality detection therefore correlates registry modification with:
unusual process
+
unexpected user relationship
+
cross-user hive access
+
suspicious timing
rather than alerting on every registry change.
Sysmon and EDR Telemetry
Organizations using Microsoft Defender for Endpoint, Sysmon, CrowdStrike, SentinelOne or similar tools should preserve enough endpoint telemetry to reconstruct:
process creation
file creation
file access where available
registry modifications
authentication events
user context
parent-child process relationships
The detection objective is to reconstruct a story.
Por exemplo:
standard user executes unfamiliar binary
|
v
second-account authentication activity
|
v
temporary filesystem objects created
|
v
profile-loading behavior
|
v
administrator UsrClass.dat accessed
|
v
registry changes appear under admin profile
That sequence is much more meaningful than detecting the word “LegacyHive” on disk.
Hunt for Pre-Patch Exposure
Organizations that deployed the August update late should consider threat hunting over the interval between public disclosure and successful patch deployment.
The relevant timeline begins in mid-July, not August 11.
Questions worth answering include:
When did public exploit information become available?
When was each endpoint patched?
Which machines allowed multiple local users?
Which machines hosted administrator logons?
Did low-privileged users execute unknown binaries?
Did unusual profile loads occur?
Were sensitive profile hives accessed cross-user?
Shared Windows hosts deserve priority.
Remediation for CVE-2026-62832
The recommended remediation is straightforward:
Install Microsoft’s August 11, 2026 security update or a later cumulative Windows update that supersedes it.
The official CVE record identifies patched build thresholds for supported affected releases. (NVD)
Do not treat disabling one local account, changing a folder ACL or blocking one PoC filename as a permanent fix.
The vulnerability exists in trusted operating-system behavior.
Vendor remediation is the correct security boundary repair.
Microsoft’s Fix
0patch’s analysis provides useful independent insight into what a safe solution must accomplish.
The researchers’ own pre-Microsoft patch changed the behavior so that a request carrying a user token would continue using an impersonated hive-loading path rather than falling back to a Local System hive load simply because full access to the file was unavailable.
When full write access was unavailable, their patched logic allowed the legitimate read-only profile case while preventing the attacker from converting a failed permission check into a privileged hive load.
After Microsoft’s August update shipped, 0patch stated that Microsoft’s patch was logically equivalent to theirs. (0patch – Better Security Patches)
The broader secure-design lesson is important:
A failed authorization check should never silently increase the authority used to perform the requested operation.
Temporary Risk Reduction When Immediate Patching Is Impossible
Organizations that cannot deploy Microsoft’s update immediately should minimize the attacker’s ability to satisfy the prerequisites.
Useful temporary measures include reducing unnecessary interactive accounts, limiting RDP access, preventing credential sharing and restricting low-privileged users from running arbitrary executables.
Shared credentials are particularly undesirable because the public LegacyHive PoC benefits from access to credentials belonging to another local account.
Application control can also reduce risk.
Windows Defender Application Control, AppLocker or equivalent EDR controls can limit arbitrary unsigned or unapproved executables running from user-writable directories.
None of these controls fixes CVE-2026-62832.
They reduce opportunity.
The hierarchy should remain:
1. Patch
2. Verify patch deployment
3. Hunt for pre-patch exploitation
4. Harden execution and account boundaries
5. Maintain behavioral detection
Why Disabling User Profile Service Is Not a Practical Fix
A tempting reaction to a service vulnerability is:
Just disable the service.
That is inappropriate here for most Windows systems.
User profiles are fundamental to normal Windows logon behavior.
Microsoft’s own documentation explains that profile hives are loaded as users sign in and store per-user configuration used throughout the desktop and application environment. (Microsoft Learn)
Breaking profile handling can create severe operational problems.
Security teams should deploy the vendor update instead of trying to remove a core operating-system function.
Why EDR Alone Is Not Enough
EDR may detect exploitation.
It does not remove the vulnerability.
This distinction matters because CVE-2026-62832 abuses legitimate operating-system mechanisms.
The attack does not inherently require:
shellcode injection
kernel driver loading
PowerShell
Mimikatz
credential dumping tools
network exploitation
An attacker can potentially build the necessary behavior into a native executable interacting with Windows APIs.
Security products may still identify the resulting activity, but prevention based solely on known-malware signatures is weaker than eliminating the vulnerable system behavior.
Patch first.
Detect second.
Comparing CVE-2026-62832 With Traditional Windows LPE Bugs
Many Windows privilege-escalation vulnerabilities are memory-safety bugs.
Typical examples include:
use-after-free
heap overflow
out-of-bounds write
integer overflow
kernel object lifetime corruption
Attackers manipulate memory until privileged control flow or privileged data can be corrupted.
CVE-2026-62832 is different.
It is fundamentally a logic vulnerability.
The attacker asks Windows to perform an operation that Windows is legitimately designed to perform.
The exploit manipulates:
which file Windows believes it is handling
when that decision is made
which security context performs the load
That difference has major implications for vulnerability research.
Modern exploit mitigations such as ASLR, DEP and Control Flow Guard are primarily designed to make memory corruption harder to weaponize.
They cannot automatically solve flawed authorization logic.
The Broader Lesson: Privileged File Operations Are Dangerous
Any privileged component that operates on user-influenced filesystem paths deserves scrutiny.
A safe implementation needs to consider:
symbolic links
junctions
reparse points
object-manager links
race conditions
directory replacement
hard links where applicable
permission changes
namespace changes
A path should not be trusted merely because it was safe milliseconds earlier.
Whenever possible, privileged code should obtain a handle to the validated object and continue operating through that stable handle rather than re-resolving a mutable path later.
CVE-2026-62832 is a concrete Windows example of this general secure-programming principle.
Why This Matters for Enterprise Windows Security
Organizations often invest heavily in preventing initial compromise while overlooking what happens after one account is breached.
But endpoint security is layered.
A malicious attachment might execute only as:
DOMAIN\employee
That is a meaningful containment boundary.
The attacker may be unable to:
dump LSASS
disable EDR
install kernel services
access administrator secrets
modify protected system directories
A local privilege-escalation vulnerability destroys that containment boundary.
CVE-2026-62832 therefore matters less as a standalone attack and more as an attack-chain accelerator.
CVE-2026-62832 in an Attack Chain
A realistic conceptual chain might look like this:
Initial Access
|
| phishing / stolen credential / browser exploit
v
Low-Privilege Windows Session
|
| attacker discovers vulnerable build
v
CVE-2026-62832
|
| cross-user registry hive manipulation
v
Administrator Execution
|
v
Privilege Escalation
|
+------> credential theft
|
+------> security control tampering
|
+------> persistence
|
+------> lateral movement
|
+------> ransomware deployment
The CVE does not necessarily perform every stage.
It removes one barrier that previously prevented later stages.
That distinction is essential when modelling real attacker behavior.
Vulnerability Scanning for CVE-2026-62832
Because CVE-2026-62832 has well-defined affected Windows build ranges, defenders do not need to run the public exploit to identify most vulnerable assets.
The safer verification strategy is version-based.
Collect:
Windows edition
Windows release
CurrentBuild
UBR
latest installed cumulative update
Then compare those values with Microsoft’s vulnerability record.
For centrally managed fleets, this information can come from:
Microsoft Intune
Microsoft Defender Vulnerability Management
Configuration Manager
WSUS
EDR inventory
Tanium
Qualys
Nessus
Rapid7
authenticated vulnerability scanners
Running exploitation code on production systems is unnecessary merely to establish patch state.
Safe Verification Versus Exploit Reproduction
Security teams sometimes conflate two different objectives.
Objective 1: Am I vulnerable?
Usually answer this using:
version information
patch inventory
Microsoft advisory data
Objective 2: Can the vulnerability actually be exploited in this environment?
This may require controlled security testing.
Such testing belongs in an isolated lab or formally authorized environment because reproducing the vulnerability necessarily manipulates Windows security boundaries and another user’s registry state.
For routine enterprise patch verification, exploit execution is usually unnecessary.
How Security Teams Should Prioritize CVE-2026-62832
CVSS alone should not determine patch priority.
A more useful model considers:
Technical severity
×
Exploit availability
×
Host role
×
Attacker opportunity
×
Business impact
Por exemplo:
Standard single-user employee laptop
Risk is meaningful but may be lower than on a shared host.
Shared RDS server
Risk increases because multiple user identities coexist naturally.
Privileged access workstation
Risk can be high because administrator profiles and credentials are especially valuable.
Jump server
Risk can be significant because compromise may create paths toward many downstream assets.
Build server or developer workstation
Risk can be substantial because local administrators may possess source-code access, signing credentials, secrets and cloud tokens.
This context-sensitive approach is more useful than treating every CVSS 7.8 vulnerability identically.
Should CVE-2026-62832 Be Patched Immediately?
Organizations should deploy the fix promptly.
The reason is not that active exploitation has already been confirmed.
It has not.
The reason is the combination of:
- public technical details;
- pre-existing proof-of-concept code;
- low privileges required;
- low attack complexity;
- no user interaction;
- high ultimate impact;
- common Windows deployment;
- usefulness in post-exploitation.
Tenable highlighted CVE-2026-62832 among the notable August vulnerabilities, noting its 7.8 score, prior public disclosure and Microsoft’s assessment that exploitation was more likely. (Tenable®)
That makes it substantially different from a purely theoretical vulnerability whose attack surface has never been demonstrated.
CVE-2026-62832 and CISA KEV
As of August 26, 2026, CVE-2026-62832 has não been established as a CISA Known Exploited Vulnerability.
CISA’s CVE enrichment records exploitation as none, while assigning “total” technical impact. (NVD)
This is worth contrasting with CVE-2026-68820, another August Windows privilege-escalation vulnerability that was actively exploited and added to the KEV catalog.
Therefore:
CVE-2026-68820:
Known exploitation
CVE-2026-62832:
Public disclosure + public technique,
no confirmed in-the-wild exploitation
Security reporting should preserve that distinction.
Frequently Asked Questions
What is CVE-2026-62832?
CVE-2026-62832 is a Windows User Profile Service elevation-of-privilege vulnerability caused by improper link resolution before file access. Microsoft classifies it as CWE-59 and gives it a CVSS 3.1 score of 7.8 High. (NVD)
Is CVE-2026-62832 the LegacyHive vulnerability?
Yes. The vulnerability publicly known as LegacyHive before the August Microsoft security release was subsequently patched and assigned CVE-2026-62832. 0patch explicitly updated its LegacyHive analysis after Microsoft’s August update to reflect the CVE assignment. (0patch – Better Security Patches)
Is CVE-2026-62832 remotely exploitable?
No.
The CVSS attack vector is Local.
An attacker needs authenticated local access or equivalent code execution on the target Windows host.
Does CVE-2026-62832 require administrator privileges?
No.
The vulnerability is specifically valuable because exploitation begins from a low-privileged account.
CVSS records PR:L.
Does exploitation require user interaction?
No.
CVSS records:
UI:N
The victim does not need to click something to trigger the underlying vulnerability. (NVD)
Is there a public proof of concept for CVE-2026-62832?
The LegacyHive proof of concept demonstrating the underlying vulnerability was publicly released in July 2026, before Microsoft assigned CVE-2026-62832. (govcert.gov.hk)
Is CVE-2026-62832 being exploited in the wild?
There is no confirmed evidence of active exploitation as of August 26, 2026.
The vulnerability was publicly disclosed before Microsoft’s patch, but public disclosure and confirmed exploitation are separate conditions. (Zero Day Initiative)
What privilege can an attacker obtain?
Microsoft states that successful exploitation can result in administrator privileges.
The underlying technique allows another user’s registry hive to become accessible or modifiable from the attacker’s context, creating opportunities to compromise privileged-user data or alter behavior executed later under the privileged account.
What is the root cause?
Microsoft classifies the issue as CWE-59 Improper Link Resolution Before File Access.
Independent LegacyHive analysis describes a TOCTOU condition in the Windows User Profile Service in which symbolic-link redirection can change the effective registry hive between an access check and the privileged load operation. (NVD)
What is ProfSvc?
ProfSvc is the Windows User Profile Service responsible for profile-management operations associated with user logon and logoff.
User profiles contain registry hives that store per-user Windows and application configuration.
How do I fix CVE-2026-62832?
Install Microsoft’s August 11, 2026 Windows security updates or later cumulative updates that supersede them.
For example, official vulnerable ranges show Windows 11 24H2 builds below 26100.9168 as affected and Windows Server 2025 builds below 26100.33296 as affected. (NVD)
Do antivirus signatures fix CVE-2026-62832?
No.
Antivirus or EDR may detect some exploitation attempts, but the operating-system vulnerability remains until the relevant Windows security update is installed.
Final Assessment
CVE-2026-62832 is an unusually instructive Windows privilege-escalation vulnerability because it demonstrates how a relatively subtle path-resolution mistake can undermine a much larger security boundary.
The weakness is not fundamentally about executing shellcode inside the kernel.
It is about persuading a trusted SYSTEM-level component to operate on a resource different from the one it believed it had validated.
Windows User Profile Service legitimately needs privileged access to registry hives.
LegacyHive turned that legitimate capability against the operating system.
By combining a mutable path, symbolic-link redirection and a gap between checking and using the target resource, a low-privileged attacker could cause Windows to load another user’s registry hive into an inappropriate security context.
The public LegacyHive research made the issue visible in July 2026. Microsoft subsequently formalized the issue as CVE-2026-62832, rated it 7.8 High, classified it as CWE-59, and corrected the vulnerability in the August 11, 2026 Windows security updates. (NVD)
There remains an important difference between risk and observed exploitation. CVE-2026-62832 has public exploit research and was known before an official fix existed, but it has not been confirmed as actively exploited in the wild as of August 26, 2026. Defenders should preserve that factual distinction rather than marketing every publicly disclosed zero-day as an active campaign.
It should nevertheless receive serious patching priority.
The vulnerability requires an attacker to already possess local access, but this is exactly the stage at which privilege-escalation flaws become valuable. Initial access gives an adversary a foothold; vulnerabilities such as CVE-2026-62832 can transform that foothold into administrative control.
For defenders, the response is therefore straightforward: deploy the current Windows cumulative updates, verify actual build revisions across the fleet, prioritize shared and privileged Windows systems, and review pre-patch telemetry for suspicious cross-user profile and registry-hive activity.
For security researchers and developers, CVE-2026-62832 provides a broader lesson that extends far beyond Windows User Profile Service:
When privileged software checks one resource and later acts on a path that can resolve to another resource, authorization can become meaningless.
That is ultimately what makes the Windows User Profile Service privilege escalation behind CVE-2026-62832 worth understanding—not only as another August Patch Tuesday CVE, but as a clear example of how identity, filesystem semantics and privileged service design can intersect to create a powerful local security failure.
Portuguese 
English 
German 
French 
Spanish 
Japanese 
Korean 
Hindi 
Arabic 
Turkish 
Hebrew