Key points
- CVE-2026-97381 affects Legacy Update versions 1.12.0 through 1.13.1 due to a failure in the IsPermitted method.
- Attackers can exploit this via Internet Explorer to enumerate system info, install updates, or force restarts.
- The vendor released version 1.13.2 to patch the origin validation error and restore proper access denial.
The short version
- A critical ActiveX flaw in Legacy Update allows unauthorized actions like installing updates and restarting PCs via malicious web pages.
- Versions 1.12.0 through 1.13.1 fail to deny access from unauthorized hostnames, returning success instead.
- Version 1.13.2 fixes the issue by correctly enforcing origin validation and denying unauthorized requests.
The details
Legacy Update is a utility designed to activate and install updates on older Windows computers. According to the National Vulnerability Database record for CVE-2026-97381, versions 1.12.0 through 1.13.1 contain a critical origin validation error within its ActiveX control. The flaw resides in the IsPermitted method, which is responsible for verifying the source of requests made to the control.
When the hosting document's hostname is read, the code checks if it is on a permitted list. If the hostname is not on that list, the logic fails to set the E_ACCESSDENIED error code. Instead, the method falls through and returns S_OK, indicating success. This behavior allows any website, regardless of its origin, to interact with the control as if it were trusted.
An attacker can exploit this by inducing a user to visit a malicious webpage using Internet Explorer. Once the page loads, the attacker can invoke the ActiveX control to perform several actions. These include enumerating update and system information, installing updates without the user's consent, displaying arbitrary dialogs, or restarting the computer if a reboot is pending. The National Vulnerability Database rates the severity of this vulnerability as critical with a CVSS score of 9.9.
The context
The weaknesses associated with this flaw are classified under CWE-346 and CWE-393. These categories relate to origin validation errors and improper verification of intent. The issue was resolved in Legacy Update version 1.13.2. This update patches the logic in the IsPermitted method to ensure that hostnames not on the permitted list are correctly denied access.
Organizations relying on Legacy Update for managing older Windows systems should verify their current version. Systems running versions prior to 1.13.2 are exposed to remote attacks via Internet Explorer. The fix ensures that the control rejects requests from unauthorized sources, preventing the unauthorized installation of updates or system restarts.
What to watch
- Monitor for any new CVEs related to Legacy Update or similar ActiveX controls.
- Track vendor announcements regarding security updates for legacy Windows management tools.
- Watch for reports of Internet Explorer exploitation in environments that still use ActiveX controls.
- Observe changes in browser support that might affect the attack surface for these controls.
What it means for organisations
Operations teams must assess their exposure to legacy software dependencies that rely on outdated browser technologies. Security leaders should determine if ActiveX controls are still in use within their infrastructure and whether they can be disabled or replaced. Procurement and supplier management teams need to verify that all third-party tools meet current security standards for origin validation. Incident response plans should include scenarios for unauthorized system restarts and update installations. Internal communication should clarify the risks of using unsupported browsers like Internet Explorer for administrative tasks.
What to do and how to stay safe: Legacy Update
- Verify the installed version of Legacy Update and upgrade to 1.13.2 or later if you are using an affected version.
- Disable Internet Explorer or restrict its use to prevent execution of ActiveX controls from untrusted web pages.
- Audit your network for systems running Legacy Update versions between 1.12.0 and 1.13.1 to identify exposure.
- Monitor system logs for unexpected update installations or restarts that could indicate exploitation of this flaw.
Step-by-step guide: Automatic Software Updates: Definition, Mechanics and Hidden Risks
General security guidance from the TechSec Headlines newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which versions of Legacy Update are affected by CVE-2026-97381?
Versions 1.12.0 through 1.13.1 are affected by this origin validation error in the ActiveX control.
How do attackers exploit this vulnerability?
Attackers induce users to visit malicious webpages in Internet Explorer, which then invoke the control to perform actions.
Is there a fix available for this issue?
Yes, the issue was fixed in Legacy Update version 1.13.2, which corrects the origin validation logic.
