« Back to list

CVE-2026-97381

Status: ReceivedCritical (9.9)—

Legacy Update is a tool for activating and installing updates on legacy Windows PCs. Legacy Update 1.12.0 through 1.13.1 contains an origin validation error in the IsPermitted method of its ActiveX control. After successfully reading the hosting document's hostname, a hostname that is not on the permitted list falls through without setting E_ACCESSDENIED, causing IsPermitted to return S_OK. An attacker who induces a user to visit a malicious webpage in Internet Explorer can invoke the control to enumerate update and system information, install updates without consent, display dialogs, or restart the computer when a reboot is pending. This issue was fixed in Legacy Update 1.13.2.

CVSS

Exploitation probability (EPSS)

FIRST hasn't scored this CVE yet (usual for very recent or rejected CVEs).

EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).

🎯 ATT&CK techniques

How this vulnerability is exploited and what the attacker gains, in MITRE ATT&CK terms.

Vector AV:N/PR:L/UI:N sin interacción del usuario según regla de precedencia; el texto indica enumeración de información del sistema y reinicio del equipo al invocar el control ActiveX.

Inferred by our analysis agent from the official description, CVSS vector and CWE, and checked by a supervisor. May contain errors.

🛡️ ATT&CK mitigations that cover these techniques

Vulnerability ScanningThreat Intelligence ProgramPrivileged Account ManagementNetwork SegmentationDisable or Remove Feature or ProgramApplication Isolation and Sandboxing

Affected technologies (1)

⚠ AI-inferred from the description — NVD hasn't analyzed this CVE yet, these aren't verified CPEs.

Legacy Update — Legacy UpdateAI

CWEs

References

Raw JSON (NVD)

Show
{
  "id": "CVE-2026-97381",
  "cveTags": [],
  "metrics": {
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 9.9,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 6,
        "exploitabilityScore": 3.1
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "LegacyUpdate",
          "product": "LegacyUpdate",
          "versions": [
            {
              "status": "affected",
              "version": ">= 1.12.0, < 1.13.2"
            }
          ]
        }
      ]
    }
  ],
  "published": "2026-10-13T22:19:45.427",
  "references": [
    {
      "url": "https://github.com/LegacyUpdate/LegacyUpdate/commit/7d62f0bfaa770d74cd6e2cb0bac9c1907df48033",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/LegacyUpdate/LegacyUpdate/commit/ae1c46c97f39a55a1937784d9f9beb30aa9147fd",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/LegacyUpdate/LegacyUpdate/releases/tag/v1.13.2.0",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/LegacyUpdate/LegacyUpdate/security/advisories/GHSA-f4g7-4gmx-jfgf",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://legacyupdate.net/news/2026/07/21/legacy-update-1-13-2",
      "source": "security-advisories@github.com"
    }
  ],
  "vulnStatus": "Received",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-346"
        },
        {
          "lang": "en",
          "value": "CWE-393"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Legacy Update is a tool for activating and installing updates on legacy Windows PCs. Legacy Update 1.12.0 through 1.13.1 contains an origin validation error in the IsPermitted method of its ActiveX control. After successfully reading the hosting document's hostname, a hostname that is not on the permitted list falls through without setting E_ACCESSDENIED, causing IsPermitted to return S_OK. An attacker who induces a user to visit a malicious webpage in Internet Explorer can invoke the control to enumerate update and system information, install updates without consent, display dialogs, or restart the computer when a reboot is pending. This issue was fixed in Legacy Update 1.13.2."
    }
  ],
  "lastModified": "2026-10-13T22:19:45.427",
  "sourceIdentifier": "security-advisories@github.com"
}