VulnSocial

CVE-2026-97381

LOWCVSS 9.9 · CRITICAL

Signal is active with 2 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

Legacy Update is a tool for activating and installing updates on legacy Windows PCs. Legacy Update 1.12.0 through 1.13.1 contains an origin validation error in the IsPermitted method of its ActiveX control. After successfully reading the hosting document's hostname, a hostname that is not on the permitted list falls through without setting E_ACCESSDENIED, causing IsPermitted to return S_OK. An attacker who induces a user to visit a malicious webpage in Internet Explorer can invoke the control to enumerate update and system information, install updates without consent, display dialogs, or restart the computer when a reboot is pending. This issue was fixed in Legacy Update 1.13.2.

Back to dashboard
0.0/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-346CWE-393

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Threat summary

  • 2 mentions across 1 observed day

What's happening

  • 2 total mentions across 1 day

Deep dive

Activity timeline2 mentions / 1d
01122Mentions · 2026-10-14: 210-14
Referenced assets2 URLs
Full discourse2 posts
  • CERT-PY@CERTpy

    ⚠️ Vulnerabilidad en Legacy Update para Windows ❗ CVE-2026-97381 ➡️ Más info: https://www.cert.gov.py/vulnerabilidad-en-legacy-update-para-windows/ https://t.co/YTGgze3BBf

    00001177
    6.7K followersView on X
  • The Hacker Wire@TheHackerWire

    🚨 CVE-2026-97381 (CVSS 9.9 Critical) Legacy Update contains an origin validation bypass in its ActiveX control, allowing malicious web pages to execute unauthorized system updates and manipulate host machine state. https://www.thehackerwire.com/vulnerability/CVE-2026-97381/ https://t.co/pomrrF8Jro

    0000058
    186 followersView on X

Explore more

Back to dashboard