Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-97381— Legacy Update ActiveX control accepts unauthorized hosting origins

Quick assessment

Affected
LegacyUpdate LegacyUpdate
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Legacy Update 是一款用于在旧版 Windows 计算机上激活和安装更新工具。Legacy Update 1.12.0 至 1.13.1 版本中，其 ActiveX 控件的 方法存在一个来源验证错误。在成功读取托管文档的主机名后，如果主机名不在允许列表中，该方法未设置 （访问被拒绝），导致 返回 （成功）。攻击者通过诱使用户在 Internet Explorer 中访问恶意网页，可以调用该控件来枚举更新和系统信息、未经用户同意安装更新、显示对话框，或在有待重启的情况下重启计算机。该问题已在 Legacy

CVSS 9.9 · Critical
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-97381

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Legacy Update ActiveX control accepts unauthorized hosting origins
Source: CVE Program / CVE List V5
Vulnerability Description
Legacy Update is a tool for activating and installing updates on legacy Windows PCs. Legacy Update 1.12.0 through 1.13.1 contains an origin validation error in the IsPermitted method of its ActiveX control. After successfully reading the hosting document's hostname, a hostname that is not on the permitted list falls through without setting E_ACCESSDENIED, causing IsPermitted to return S_OK. An attacker who induces a user to visit a malicious webpage in Internet Explorer can invoke the control to enumerate update and system information, install updates without consent, display dialogs, or restart the computer when a reboot is pending. This issue was fixed in Legacy Update 1.13.2.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
源验证错误
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
LegacyUpdate LegacyUpdate >= 1.12.0, < 1.13.2 -

II. Public POCs for CVE-2026-97381

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-97381

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-97381 (2)

Vendor Advisories for CVE-2026-97381 (2)

IV. Related Vulnerabilities

Same weakness: CWE-346

V. Comments for CVE-2026-97381

No comments yet

Leave a comment