CVE-2026-97381 Details
Description
Legacy Update is a tool for activating and installing updates on legacy Windows PCs. Legacy Update 1.12.0 through 1.13.1 contains an origin validation error in the IsPermitted method of its ActiveX control. After successfully reading the hosting document's hostname, a hostname that is not on the permitted list falls through without setting E_ACCESSDENIED, causing IsPermitted to return S_OK. An attacker who induces a user to visit a malicious webpage in Internet Explorer can invoke the control to enumerate update and system information, install updates without consent, display dialogs, or restart the computer when a reboot is pending. This issue was fixed in Legacy Update 1.13.2.
A vulnerability exists in the Legacy Update tool for Windows PCs, specifically in versions 1.12.0 through 1.13.1. The issue arises from an origin validation error in the ActiveX control's IsPermitted method. This flaw allows an attacker to manipulate the control into accepting unauthorized hostnames, bypassing security checks. As a result, the control can be used to access and modify system settings, such as installing updates without permission or triggering unwanted dialog boxes. The vulnerability can be exploited by convincing a user to visit a malicious webpage using Internet Explorer.
Users are advised to update to Legacy Update version 1.13.2, which addresses the vulnerability by correcting the origin validation error and implementing additional security measures. After updating, the system will block earlier versions of the ActiveX control, ensuring the vulnerability remains mitigated.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 13, 2026CISA-ADP
Assessed Oct 17, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-346 | Origin Validation Error | [email protected] |
| CWE-393 | Return of Wrong Status Code | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Legacy Update | >= 1.12.0, < 1.13.2 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 17, 2026 | CVE Modified | CISA-ADP |
| Oct 13, 2026 | New CVE Received | [email protected] |