Improper link resolution before file access

CVE-2026-62832 is a privilege escalation flaw in the Windows User Profile Service (ProfSvc), the component responsible for loading user registry hives (ntuser.dat, UsrClass.dat) during sign-in. By abusing NT Object Manager symbolic links and opportunistic locks, a low-privileged local attacker can race the profile-loading logic and coerce ProfSvc into mounting a target user's registry hive in the attacker's security context — ultimately achieving SYSTEM or administrator privileges. Affected versions span all currently supported Windows: Windows 10 (21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1), and Windows Server 2022 and 2025.

Microsoft rated this Important / CVSS 7.8 HIGH, and for once the vendor label is correct. The local-access prerequisite and the unusual requirement for credentials to a *second* local account provide genuine friction that keeps this below CRITICAL. However, the LegacyHive proof-of-concept released by Nightmare-Eclipse in July 2026 is fully weaponized, independently verified on fully patched systems, and reportedly adopted by DPRK's Lazarus Group for the Operation Dream Job campaign. That active exploitation prevents any downgrade. The vendor score stands.

Why this verdict

• Active exploitation offsets local-access friction. Lazarus Group has operationalized this vulnerability in the Operation Dream Job campaign, demonstrating that the local-access and two-account requirements are surmountable for motivated attackers who already have initial footholds.
• Weaponized PoC with 27-day head start. The LegacyHive PoC was public and verified for nearly a month before Microsoft shipped a fix. Any attacker with a foothold during that window had a reliable, high-success-rate escalation primitive.
• Universal attack surface. Every supported Windows desktop and server OS is affected. There is no version-specific narrowing — this is a billions-of-endpoints vulnerability class.
• Role multiplier: On workstations (low-value role), exploitation yields local admin — useful for persistence but blast radius is host-scoped. On member servers (typical role), SYSTEM access enables lateral movement and credential harvesting. On domain controllers (high-value role), SYSTEM access on a DC equals domain admin equivalent — the chain ends in full domain compromise. However, DCs rarely have standard user local logons, and the two-account prerequisite is harder to meet on a DC. On Windows-based hypervisors (Hyper-V) and backup servers (Veeam, Commvault on Windows Server), SYSTEM access enables fleet-scale or data-destruction-scale impact. The DC/Hyper-V/backup floor is HIGH, which the vendor score already meets.
• Friction: two-account requirement. Unlike typical LPE bugs that require only a single low-priv session, LegacyHive needs valid credentials for a *second* local account. This is a genuine narrowing — not every compromised host will have a second exploitable account. This friction prevents elevation to CRITICAL despite the nation-state exploitation.

Why not higher?

CRITICAL would require either unauthenticated remote exploitation or a simpler local chain. This vulnerability demands local access *plus* credentials for a second local account, which is an unusual and meaningful friction point. The Scope is Unchanged (no hypervisor escape, no cross-tenant blast), and the two-account requirement significantly limits opportunistic exploitation at scale. While DCs are theoretically in scope, the practical likelihood of meeting both prerequisites on a DC is low.

Why not lower?

Active nation-state exploitation by Lazarus Group eliminates any case for MEDIUM. A weaponized PoC that was publicly available for 27 days before patching means the exploit is proven reliable and already in adversary toolkits. The universal Windows attack surface (every supported version affected) ensures that any organization running Windows has exposed hosts. The role-multiplier floor from DC and Hyper-V deployments anchors this at HIGH minimum.

1. Deploy August 2026 cumulative updates immediately — The patch is the definitive fix. Given active exploitation, treat this as an emergency patch cycle. Under the noisgate mitigation SLA for HIGH, deploy compensating controls within 30 days, but active exploitation warrants faster action — aim for 7-14 days for patch rollout.
2. Audit and disable unnecessary local accounts on all Windows hosts — The exploit requires credentials for a second local account. Remove or disable dormant local accounts, service accounts with local logon rights, and any shared/default accounts. Deploy LAPS (Local Administrator Password Solution) if not already in place to eliminate shared local admin passwords.
3. Restrict local logon rights via Group Policy — Use Allow log on locally and Deny log on locally GPO settings to limit which accounts can perform interactive logons. On servers and especially domain controllers, restrict local logon to only domain admin and necessary service accounts.
4. Deploy Sysmon or EDR rules for LegacyHive IOCs — Monitor for: GUID-named directories under C:\, unusual CreateProcessWithLogonW calls, NtCreateSymbolicLinkObject API usage, and modifications to User Shell Folders registry keys. Windows Event IDs 4648, 4663, and 4657 are key detection points.
5. Enable Credential Guard on Windows 10/11 Enterprise and Server — While Credential Guard does not prevent the privilege escalation itself, it limits the post-exploitation value by protecting cached domain credentials from extraction after SYSTEM is achieved.

Run this script on each target Windows host as any user (no admin required). Execute with: powershell -ExecutionPolicy Bypass -File .\Check-CVE-2026-62832.ps1. It checks whether the August 2026 cumulative update has been applied by examining the OS build number.

#Requires -Version 5.1
<# Check-CVE-2026-62832.ps1
   Checks whether the host is patched against CVE-2026-62832
   (Windows User Profile Service EoP - LegacyHive)
   Exit codes: 1 = VULNERABLE, 0 = PATCHED, 2 = UNKNOWN
#>

$ErrorActionPreference = 'Stop'

# August 2026 Patch Tuesday minimum build numbers (cumulative update)
# These represent the minimum patched build for each Windows version
$patchedBuilds = @{
    # Windows 10 21H2 / 22H2 (19041-19045 series)
    '10.0.19044' = 6553
    '10.0.19045' = 6553
    # Windows 11 23H2
    '10.0.22631' = 5370
    # Windows 11 24H2
    '10.0.26100' = 3915
    # Windows 11 25H2
    '10.0.26120' = 3915
    # Windows Server 2022
    '10.0.20348' = 3775
    # Windows Server 2025
    '10.0.26100' = 3915
}

try {
    $os = Get-CimInstance Win32_OperatingSystem
    $build = [System.Environment]::OSVersion.Version
    $fullVersion = "$($build.Major).$($build.Minor).$($build.Build)"
    $ubr = (Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name UBR).UBR

    Write-Host "OS: $($os.Caption)"
    Write-Host "Build: $fullVersion.$ubr"

    if ($patchedBuilds.ContainsKey($fullVersion)) {
        $requiredUBR = $patchedBuilds[$fullVersion]
        if ($ubr -ge $requiredUBR) {
            Write-Host "PATCHED - UBR $ubr >= required $requiredUBR"
            exit 0
        } else {
            Write-Host "VULNERABLE - UBR $ubr < required $requiredUBR (need August 2026 cumulative update)"
            exit 1
        }
    } else {
        # Check if it is Windows at all
        if ($os.Caption -notmatch 'Windows') {
            Write-Host "UNKNOWN - Not a Windows system"
            exit 2
        }
        # Might be an older unsupported version
        Write-Host "UNKNOWN - Build $fullVersion not in check list. Verify manually against Microsoft advisory."
        exit 2
    }
} catch {
    Write-Host "UNKNOWN - Error during check: $_"
    exit 2
}

Sources

1. CrowdStrike August 2026 Patch Tuesday Analysis
2. Feedly CVE-2026-62832 Intelligence
3. Rescana - LegacyHive Zero-Day Technical Analysis
4. BleepingComputer - Microsoft August 2026 Patch Tuesday
5. SANS ISC - Microsoft Patch Tuesday August 2026
6. IT-Connect - LegacyHive Zero-Day After July Patch Tuesday
7. Nightmare-Eclipse LegacyHive Disclosure (X/Twitter)