New Windows LegacyHive zero-day gives hackers admin privileges
2026-07-17T13:23:29Z•5f83cbc4fbe5a08f3858ba410b8ecc977f9ebd7fcbe20c326c5cce71a023b130
CISAClaudeClickLockFairlifeFortiSandboxFortinetLegacyHiveOkoBotOracle E-Business SuiteSpiralsStarland RATactively-exploitedchrome-extensioncryptocurrency-theftincident-responseinfo-stealermacOSmalwarepatchingprivilege-escalationransomwaresupply-chaintrojanized-softwarewindowszero-day
What happened
Multiple high-impact incidents reported: a newly disclosed Windows zero-day dubbed "LegacyHive" (researcher handle "Nightmare Eclipse") enables privilege escalation to administrator on up-to-date Windows systems; CISA has ordered immediate patching for actively exploited vulnerabilities in Fortinet FortiSandbox and an actively exploited critical Oracle E-Business Suite flaw; and fast-moving ransomware and malware campaigns continue (Fairlife/Coca‑Cola disruption, new Spirals ransomware, OkoBot payload framework, Starland RAT delivered via trojanized WebEx/Zoom installers). Additional notable:
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- bleepingcomputer
- Record identifier
- 5f83cbc4fbe5a08f3858ba410b8ecc977f9ebd7fcbe20c326c5cce71a023b130
- Enrichment time
- 2026-07-17T13:23:29Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.