CVE-2015-0004Exploit(microsoft / windows_7)

MEDIUMCVSS 7.2 · HIGH

Exploit discussion active in current signal (1 latest mentions)

Immediate actions

Patch microsoft windows_7 systems immediately
Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft

Recommended action window: High priority (within 72h)

NVD description

The User Profile Service (aka ProfSvc) in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows local users to gain privileges by conducting a junction attack to load another user's UsrClass.dat registry hive, aka MSRC ID 20674 or "Microsoft User Profile Service Elevation of Privilege Vulnerability."

microsoft CVEs Back to dashboard

4.5/ 10 priority

Sources & remediation

Exploit / PoC references

Other references

Weakness type (CWE)

CWE-264

Priority

MEDIUM

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

windows_7
windows_8
windows_8.1
windows_rt

Threat summary

Public PoC and exploit tooling are both present
Patch or workaround signal is available
2 mentions across 2 observed days
Momentum state: stable

What's happening

Exploit tool or code specified in 1 signal
PoC mentioned or linked in 1 signal
Patch or workaround mentioned in 1 signal
Technical details provided in 2 signals
Disclosure: 1 classified signal
Peaked 1d ago at 1 mentions (2026-07-14); latest day: 1
2 total mentions across 2 days

Affected systems

Vendors

microsoft

Products

windows_7windows_8windows_8.1windows_rtwindows_rt_8.1windows_server_2003windows_server_2008windows_server_2012windows_vista

2 versions affected across 9 products

Deep dive

Activity timeline2 mentions / 2d

Signal classification2 categories

Exploit

150.0%

Disclosure

150.0%

Classification over time

Date	Total	Labels

2026-07-14	1	Exploit1
2026-07-17	1	Disclosure1

Full discourse2 posts

Rıdvan Yağlı@ridvanyagli91d
Exploit
🔴 Yeni Windows 0-Day LPE: LegacyHive Nightmare-Eclipse, Windows User Profile Service'i hedef alan yeni bir zero-day PoC yayımladı. İddiaya göre Temmuz 2026 yamalı Windows sürümlerinde bile çalışıyor ve eski CVE-2015-0004 hata sınıfını yeni bir path-swap tekniğiyle yeniden canlandırıyor. Şu an için CVE yok! Microsoft açıklaması yok! PoC GitHub'da mevcut.
Post summary
Nightmare‑Eclipse released a zero‑day local privilege escalation PoC targeting the Windows User Profile Service, with path‑swap technique and code available on GitHub, but no evidence of active exploitation or a vendor patch has been reported.
001921.5K
2.2K followersView on X
Onyx_Digital@BaximusCyber8589d
Disclosure
@IntCyberDigest @msftsecurity @msftsecresponse @ChaoticEclipse0 @Dinosn @GossiTheDog The next day, ICD reported LegacyHive itself: a path-switching trick that makes Windows mount another user's Registry hive under a helper account. ICD notes it echoes CVE-2015-0004, a near-identical ProfSvc trust-boundary bug Microsoft patched in 2015. https://t.co/CY6xs8FgM1
Post summary
ICD reports a new path‑switching technique (LegacyHive) that mirrors the old CVE‑2015‑0004 vulnerability, noting that the original issue was patched in 2015.
1000047
243 followersView on X

CPE platform detail11 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

11 of 11 entries

Part	Vendor	Product	Version	Target SW	Target HW
OS	microsoft	windows_7	-	-	-
OS	microsoft	windows_8	-	-	-
OS	microsoft	windows_8.1	-	-	-
OS	microsoft	windows_rt	-	-	-
OS	microsoft	windows_rt_8.1	-	-	-
OS	microsoft	windows_server_2003	-	-	-
OS	microsoft	windows_server_2008	-	-	-
OS	microsoft	windows_server_2008	r2	-	-
OS	microsoft	windows_server_2012	-	-	-
OS	microsoft	windows_server_2012	r2	x64	-
OS	microsoft	windows_vista	-	-	-

Explore more

Back to dashboard microsoft CVEs windows_7 vulnerabilities