CVE-2026-97381Legacy Update ActiveX control accepts unauthorized hosting origins
Updated under an hour ago ()
Does this affect you?
It affects LegacyUpdate. Add what you run to find out whether that includes you.
EPSS puts the chance of exploitation in the next 30 days at 0.21%, higher than 11% of scored CVEs.
Do this next
Free account, 1 product
Legacy Update is a tool for activating and installing updates on legacy Windows PCs. Legacy Update 1.12.0 through 1.13.1 contains an origin validation error in the IsPermitted method of its ActiveX control. After successfully reading the hosting document's hostname, a hostname that is not on the permitted list falls through without setting E_ACCESSDENIED, causing IsPermitted to return S_OK. An attacker who induces a user to visit a malicious webpage in Internet Explorer can invoke the control to enumerate update and system information, install updates without consent, display dialogs, or restart the computer when a reboot is pending. This issue was fixed in Legacy Update 1.13.2.
- CVSS
- 9.9 CRITICAL (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
- Weakness (CWE)
- CWE-346, CWE-393
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- 0.21% (percentile 11)
- Assigned by
- GitHub_M
- NVD analysis
- Deferred
- Record last updated
- Oct 17, 2026
- First seen by InfoSec Signals
- Oct 13, 2026
Affected products
LegacyUpdate LegacyUpdate legacyupdate:legacyupdate (from the name) | from 1.12.0, < 1.13.2 | CNA record |
References
- https://github.com/LegacyUpdate/LegacyUpdate/security/advisories/GHSA-f4g7-4gmx-jfgfx-refsource-confirm
- https://github.com/LegacyUpdate/LegacyUpdate/commit/7d62f0bfaa770d74cd6e2cb0bac9c1907df48033x-refsource-misc
- https://github.com/LegacyUpdate/LegacyUpdate/commit/ae1c46c97f39a55a1937784d9f9beb30aa9147fdx-refsource-misc
- https://github.com/LegacyUpdate/LegacyUpdate/releases/tag/v1.13.2.0x-refsource-misc
- https://legacyupdate.net/news/2026/07/21/legacy-update-1-13-2x-refsource-misc
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.