{"id":372815,"date":"2026-07-27T20:26:46","date_gmt":"2026-07-27T14:56:46","guid":{"rendered":"https:\/\/ebiztoday.news\/?p=372815"},"modified":"2026-07-27T20:26:46","modified_gmt":"2026-07-27T14:56:46","slug":"windows-0-day-drops-the-identical-day-microsoft-releases-record-variety-of-patches","status":"publish","type":"post","link":"https:\/\/ebiztoday.news\/index.php\/2026\/07\/27\/windows-0-day-drops-the-identical-day-microsoft-releases-record-variety-of-patches\/","title":{"rendered":"Windows 0-day drops the identical day Microsoft releases record variety of patches"},"content":{"rendered":"
\n

\u201cIf I can arrange the system in order that it runs my code when the admin user logs in,\u201d the attacker has de facto administrator privileges, Will Dormann, a senior principal vulnerability analyst at Tharros Labs, said in an interview. \u201cI don\u2019t should be an admin myself.\u201d<\/p>\n

In a post<\/a>, he said that \u201cthe power of a non-admin user to find a way to switch the classes registry hive of an admin user is a reasonably powerful primitive. Clever attackers or individuals who want to perform something will easily find a way to determine do things which are more interesting and\/or don\u2019t even require user interaction.\u201d<\/p>\n

Dormann said that the exploit could possibly be chained to a separate one that provides direct access to an administrative account.<\/p>\n

As explained in a post<\/a> by a special analyst: \u201cWhen a brand new user is logging on, Windows must load the user\u2019s class hive. Because the user isn\u2019t logged on before logging on (tautology, I do know), it might\u2019t be loaded within the context of the user. So it’s loaded within the context of NT AUTHORITYSYSTEM. LegacyHive abuses this.\u201d<\/p>\n

In an emailed statement, Microsoft said it\u2019s aware of the vulnerability report and is investigating. The corporate also noted its preference that vulnerability reporters follow a coordinated disclosure<\/a> policy.<\/p>\n

For now, Windows users who need to protect their systems against HiveLegacy can run a detection script<\/a> published by independent researcher Kevin Beaumont. Other defenses are to limit local non-user account creation, monitor ProfSvc for unexpected hive loads, and track NTUSER.DAT\/UsrClass.dat activity.<\/p>\n<\/p><\/div>\n

<\/p>\n","protected":false},"excerpt":{"rendered":"

\u201cIf I can arrange the system in order that it runs my code when the admin user logs in,\u201d the attacker has de facto administrator privileges, Will Dormann, a senior principal vulnerability analyst at Tharros Labs, said in an interview. \u201cI don\u2019t should be an admin myself.\u201d In a post, he said that \u201cthe power […]<\/p>\n","protected":false},"author":1,"featured_media":372816,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[10],"tags":[24170,1999,2525,92,2343,19218,971,1167,2379],"class_list":["post-372815","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-technology","tag-0day","tag-day","tag-drops","tag-microsoft","tag-number","tag-patches","tag-record","tag-releases","tag-windows"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t