Legacy Update: Origin validation error in ActiveX control
Summary
Legacy Update, a tool for installing updates on legacy Windows PCs, has an origin validation error in the IsPermitted method of its ActiveX control. Hosting pages whose hostname is not on the permitted list are wrongly accepted. An attacker who lures a user to a malicious webpage in Internet Explorer can list update and system information, install updates without consent, display dialogs, or restart the computer when a reboot is pending. The CVSS score is 9.9 (critical).
Affected
- Legacy Update 1.12.0 through 1.13.1
Fixed in
- Legacy Update 1.13.2 (released 21 July 2026)
Workaround
- Stop using Internet Explorer.
- Reject unexpected UAC prompts.
- Keep Internet Explorer in Protected Mode and do not run it as administrator.
- The vendor states that upgrading is the only complete fix.
Exploitation
- No public proof of concept found at time of research.
- CISA SSVC assessment: exploitation none, not automatable, total technical impact.
- No evidence of exploitation in the wild found; verify the CISA KEV catalogue directly.
Our recommendation
- Update Legacy Update to 1.13.2 or later as soon as possible; the vendor's current release is 1.14.1.
- Identify legacy Windows PCs with Legacy Update or Internet Explorer and check their exposure.
- Keep such systems isolated from the general network and block web browsing from them where possible.
- Monitor for unexpected update installations or restarts.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-f4g7-4gmx-jfgf github.com
- Legacy Update 1.13.2 news post legacyupdate.net
- Legacy Update v1.13.2.0 release github.com
- Fix commit 7d62f0b github.com
- Legacy Update release history legacyupdate.net
- OSV entry CVE-2026-97381 osv.dev
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 15:22.
Original description (NVD)
Legacy Update is a tool for activating and installing updates on legacy Windows PCs. Legacy Update 1.12.0 through 1.13.1 contains an origin validation error in the IsPermitted method of its ActiveX control. After successfully reading the hosting document's hostname, a hostname that is not on the permitted list falls through without setting E_ACCESSDENIED, causing IsPermitted to return S_OK. An attacker who induces a user to visit a malicious webpage in Internet Explorer can invoke the control to enumerate update and system information, install updates without consent, display dialogs, or restart the computer when a reboot is pending. This issue was fixed in Legacy Update 1.13.2.
NVD references (5)
- https://github.com/LegacyUpdate/LegacyUpdate/commit/7d62f0bfaa770d74cd6e2cb0bac9c1907df48033
- https://github.com/LegacyUpdate/LegacyUpdate/commit/ae1c46c97f39a55a1937784d9f9beb30aa9147fd
- https://github.com/LegacyUpdate/LegacyUpdate/releases/tag/v1.13.2.0
- https://github.com/LegacyUpdate/LegacyUpdate/security/advisories/GHSA-f4g7-4gmx-jfgf
- https://legacyupdate.net/news/2026/07/21/legacy-update-1-13-2
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.