CVE-2026-97381
Critical · CVSS 9.9Published 2026-10-13
CVSS
9.9
Critical
EPSS
—
exploit probability
Active Exploit
No
not yet listed
What is CVE-2026-97381?
Legacy Update is a tool for activating and installing updates on legacy Windows PCs. Legacy Update 1.12.0 through 1.13.1 contains an origin validation error in the IsPermitted method of its ActiveX control. After successfully reading the hosting document's hostname, a hostname that is not on the permitted list falls through without setting E_ACCESSDENIED, causing IsPermitted to return S_OK. An attacker who induces a user to visit a malicious webpage in Internet Explorer can invoke the control to enumerate update and system information, install updates without consent, display dialogs, or restart the computer when a reboot is pending. This issue was fixed in Legacy Update 1.13.2.
CVSS Score Explained
CVSS 9.9 is Critical — the highest severity tier. Attackers can likely exploit this remotely with no authentication and cause full system compromise. Patch immediately.
EPSS Exploitation Probability
No EPSS score yet — model needs more data on this CVE.
References & Patches
- PATCHhttps://github.com/LegacyUpdate/LegacyUpdate/commit/7d62f0bfaa770d74cd6e2cb0bac9c1907df48033
- PATCHhttps://github.com/LegacyUpdate/LegacyUpdate/commit/ae1c46c97f39a55a1937784d9f9beb30aa9147fd
- PATCHhttps://github.com/LegacyUpdate/LegacyUpdate/releases/tag/v1.13.2.0
- PATCHhttps://github.com/LegacyUpdate/LegacyUpdate/security/advisories/GHSA-f4g7-4gmx-jfgf
- PATCHhttps://legacyupdate.net/news/2026/07/21/legacy-update-1-13-2
Track vulnerabilities for your stack
Tell us what tech you run — Node.js, Python, Java, nginx, whatever — and get a weekly email when new CVEs affect it.
Recent CVEs
- CVE-2026-88964An integer underflow in OpenVPN version 2.7_alpha3 through 2.7.7 on Windows and Android allows remote authenticated servers to cause a denial of service or memory disclosure via crafted domain search options7.1
- CVE-2026-53564Vulnerability in Citrix UniconOS leading to Arbitrary file read and write
This issue affects UniconOS: before 2607.2 CR and before 2603 LTSR CU2.5.1
- CVE-2026-15468Authorization bypass through User-Controlled key vulnerability in HYPR Passwordless on Windows allows Privilege Escalation.
This issue affects HYPR Passwordless: before 11.3.3.6.9
- CVE-2026-53563Vulnerability in Citrix UniconOS leading to Persistent Command Execution
This issue affects UniconOS: before 2607.2 CR and before 2603 LTSR CU2.6.9
- CVE-2026-105142Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.—
- CVE-2026-105151Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.—