July 2026 has been a rough month for patching. In the past seven days alone, we saw Zoom fix an account takeover hole that requires no credentials and no user interaction, F5 release an out-of-band patch for a heap buffer overflow in NGINX with a CVSS score of 9.2, and the researcher known as Nightmare Eclipse drop yet another unpatched Windows local privilege escalation exploit, this one called LegacyHive.
These are not theoretical bugs. They are live, exploitable, and in the case of the Zoom and NGINX issues, already patched. If you run any of these products in production, you need to move.
Let me walk through each one, what it means, and what you should do.
Zoom patches a critical account takeover hole
Zoom released patches on Wednesday for a vulnerability in its Windows Desktop Client that lets an unauthenticated attacker take over a user's account over the network. The security bulletin, published Tuesday, listed the bug as affecting Zoom Desktop Client for Windows before version 7.0.0, Zoom VDI Client for Windows before certain versions, and Zoom Meeting SDK for Windows. A day later, Zoom removed Meeting SDK from the affected list without explanation.
The researcher who analyzed the bug, Dickson from (presumably) some security firm, told Computerworld that "this bug is about as bad as it gets, short of a worm. It is exploitable over the network, low complexity, zero privileges required, no user interaction needed." He also warned that once technical details leak or someone reverse-engineers the patch, exploitation becomes easy. "Yesterday's script kiddies have been empowered," he said, pointing to AI-assisted reverse engineering.
The theory is that the flaw involves mishandling of deep links. Zoom uses custom URL schemes like zoommtg:// and zoomworkplace:// to launch meetings from browsers. If the Windows client does not properly sanitize incoming arguments, an attacker could craft a malicious string that tricks the application into exposing session tokens to an attacker-controlled server. That gives them a silent account takeover.
Zoom also patched three privilege escalation bugs in various Windows products, including Zoom Workplace, Zoom Rooms, and Remote Control for Zoom Contact Center. These are less severe but still worth patching because they can turn a minor foothold into a full compromise.
The good news: Zoom found the hole itself and no in-the-wild exploitation has been reported as of Thursday. The bad news: there are a lot of Zoom clients out there, and many users never update.
If you manage Zoom deployments, push version 7.0.0 or later for the Desktop Client immediately. The VDI patches are version-specific, so check the bulletin for your branch.
F5 patches NGINX heap buffer overflow (CVE-2026-42533)
On July 16, F5 released an out-of-band security advisory for a heap buffer overflow in NGINX Plus and NGINX Open Source. The vulnerability, CVE-2026-42533, has a CVSS score of 9.2 and requires no authentication. An unauthenticated attacker can trigger it by sending a crafted HTTP request to the affected component.
Heap buffer overflows in web servers are dangerous. They let an attacker write data beyond a heap allocation, potentially overwriting adjacent memory structures. That can lead to arbitrary code execution, process crashes, or information disclosure. The advisory, K000161837, is separate from the emergency QUIC module patches F5 issued in June. The QUIC patches do not protect against this vulnerability. They are different attack surfaces.
Notable: F5 has not disclosed the specific patched version numbers in the public advisory. Fixes are available through the Broadcom support portal. If you run NGINX Plus or NGINX Open Source, you need to log into the portal and find the patched versions. This is frustrating because it prevents quick verification against your inventory. I suspect F5 is being cautious about giving attackers a target version to compare against, but it makes life harder for defenders.
NGINX is deployed on about 30 percent of the top one million websites, according to Netcraft. Many enterprises use it as a reverse proxy, load balancer, TLS termination point, and API gateway. Every internet-facing NGINX instance that fronts multiple backend applications represents a risk surface. If an attacker exploits CVE-2026-42533 on that NGINX box, they may be able to pivot to the backend applications. Prioritize internet-facing instances first, especially if ASLR is not at standard configuration.
The June QUIC patches and this HTTP processing patch represent two independent lines of NGINX security research that happened to produce emergency patches in the same calendar period. That is an unusual pattern. It suggests that researchers are looking hard at NGINX, and more bugs may surface.
Nightmare Eclipse drops LegacyHive zero-day
Nightmare Eclipse, the researcher who has been releasing unpatched Windows zero-days since 2024, dropped another one on July 14, right on Patch Tuesday. The exploit, called LegacyHive, is a local privilege escalation in the Windows User Profile Service. It lets an attacker load other users' hives, including administrator hives.
The proof-of-concept code works on systems running Microsoft's July 2026 patches. The researcher says the PoC requires credentials for a standard user and a third username (which can be an admin account). If successful, it mounts the target user's hive in the current user's classes root.
This time, Nightmare Eclipse released a stripped PoC to prevent in-the-wild exploitation. The original exploit did not require user credentials and allowed any hive to be loaded, not just usrclass.dat. That is still possible, the researcher says, but it would require more work.
Microsoft's response, quoted by SecurityWeek: "Microsoft is aware of the reported vulnerability and is actively investigating the validity and potential applicability of these claims." Standard language. No patch yet.
Nightmare Eclipse has released over half a dozen Windows zero-days, including BlueHammer, RedSun, and UnDefend, which have been exploited in the wild. So far, no exploitation of LegacyHive has been reported.
Local privilege escalation bugs like this matter because they are the second step in many attack chains. An attacker gets initial access through a phishing email or a vulnerable service, then uses a bug like LegacyHive to escalate to SYSTEM or administrator. If you have not already, consider restricting user credential exposure, enabling Windows Defender Credential Guard, and monitoring for unusual registry hive loading.
Practical takeaways
Three different classes of vulnerability, three different products, and each one demands attention.
For Zoom, the fix is straightforward: update the Windows client to the latest version. The VDI and Workplace patches are also available. The real challenge is getting users to update. If you manage Windows endpoints, automate the Zoom update process.
For NGINX, the situation is more opaque because F5 has not published version numbers. Log into the Broadcom portal and check your NGINX Plus builds. For NGINX Open Source, check the changelog or reach out to your distribution maintainer. Prioritize internet-facing instances.
For LegacyHive, there is no patch. Microsoft is investigating. In the meantime, assume this exploit works on fully patched Windows 11 and Server 2022 machines. Review your privilege boundaries. Consider running high-value accounts with restricted token protection.
None of these bugs are the end of the world by themselves. But they show how the vulnerability landscape is shifting. AI-assisted reverse engineering is making it easier to weaponize patches quickly. The Zoom researcher noted that. Script kiddies are getting more capable. The gap between patch release and exploit availability is shrinking.
Patch fast, assume you will be targeted, and monitor for the signs.