CVE-2026-97381

Name of the Vulnerable Software and Affected Versions Legacy Update versions 1.12.0 through 1.13.1

Description An origin validation error exists in the IsPermitted() method of the ActiveX control. When the hosting document's hostname is not on the permitted list, the system fails to set E ACCESSDENIED, causing the function to return S OK. An attacker can exploit this by inducing a user to visit a malicious webpage via Internet Explorer to invoke the control. This allows the attacker to enumerate system and update information, install updates without user consent, display dialogs, or restart the computer if a reboot is pending.

Recommendations Update Legacy Update to version 1.13.2.