All vulnerabilities
CVE-2026-97381GHSA-f4g7-4gmx-jfgf

LegacyUpdate: Legacy Update ActiveX control accepts unauthorized hosting origins

LegacyUpdate LegacyUpdate
Open in ThreatlineRecord JSON
CVSS
9.9Critical
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.21%Chance of exploitation activity in the next 30 days, higher than 11% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in1.13.2Fixed versionGitHub
Published13 Oct 2026Updated 17 Oct 2026CVE List

What fixes it

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Legacy Update is a tool for activating and installing updates on legacy Windows PCs. Legacy Update 1.12.0 through 1.13.1 contains an origin validation error in the IsPermitted method of its ActiveX control. After successfully reading the hosting document's hostname, a hostname that is not on the permitted list falls through without setting E_ACCESSDENIED, causing IsPermitted to return S_OK. An attacker who induces a user to visit a malicious webpage in Internet Explorer can invoke the control to enumerate update and system information, install updates without consent, display dialogs, or restart the computer when a reboot is pending. This issue was fixed in Legacy Update 1.13.2.

Text from CVE List

Affected versions 2

  • LegacyUpdateaffected: >= 1.12.0, < 1.13.2CVE List
  • Legacy Update>= 1.12.0 < 1.13.2GitHub

References 5