Key points
- CVE-2026-97381 is rated CVSS 9.9 Critical due to remote code execution risks.
- The flaw exists in the IsPermitted method of the tool's ActiveX control.
- Legacy Update 1.13.2 patches the vulnerability by fixing the validation logic.
A critical security flaw in Legacy Update allows attackers to take control of systems and force restarts by tricking users into visiting malicious websites. This vulnerability, tracked as CVE-2026-97381, affects versions 1.12.0 through 1.13.1 of the software used for managing updates on older Windows computers. The issue stems from a failure in how the tool validates the source of requests, enabling unauthorized actions that compromise system integrity and user consent.
How it unfolded
- Legacy Update versions 1.12.0 through 1.13.1 contained an origin validation error in the IsPermitted method of its ActiveX control.
- The flaw allowed hostnames not on the permitted list to bypass security checks without triggering an access denied error.
- Legacy Update 1.13.2 was released to fix the issue by ensuring proper validation of request origins.
Who is affected
System administrators managing legacy Windows PCs using Legacy Update versions 1.12.0 through 1.13.1 are at risk. The vulnerability allows an attacker to invoke the ActiveX control if a user visits a malicious webpage in Internet Explorer. This exposure enables the enumeration of update and system information without user permission. Organizations relying on this tool for maintenance on older machines must verify their version numbers immediately to determine if they fall within the affected range.
What happens next
Attackers can exploit this flaw to install updates without consent, display deceptive dialogs, or restart the computer when a reboot is pending. The National Vulnerability Database rates the severity as Critical with a CVSS score of 9.9. The weaknesses are classified under CWE-346 and CWE-393. Since the vendor has released version 1.13.2, the immediate remediation step is to upgrade. Systems running older versions remain vulnerable to remote manipulation until patched.
The background in plain language
ActiveX controls are software components that run within Internet Explorer to extend its functionality. Origin validation ensures that only trusted websites can interact with these powerful components. When this check fails, malicious sites can trigger actions as if they were legitimate. Teams usually monitor for such bypasses by testing how controls respond to unauthorized hostnames. Check whether your environment restricts ActiveX usage to prevent unauthorized system changes from untrusted sources.
What to do and how to stay safe: Legacy Update
- Verify the version of Legacy Update installed on all managed systems to identify exposure.
- Upgrade to Legacy Update 1.13.2 or later to apply the vendor's patch for CVE-2026-97381.
- Restrict the use of Internet Explorer to prevent execution of malicious ActiveX controls.
- Monitor system logs for unauthorized update installations or unexpected restarts.
General security guidance from the Circuit Observer newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVSS score for CVE-2026-97381?
The CVSS score is 9.9, which is rated as Critical severity by the National Vulnerability Database.
Which versions of Legacy Update are affected?
Versions 1.12.0 through 1.13.1 are affected by the origin validation error in the ActiveX control.
How can an attacker exploit this vulnerability?
An attacker can induce a user to visit a malicious webpage in Internet Explorer to invoke the control.
