CVE-2026-97381
Raw vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:HCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2026-97381 is a critical-severity Origin Validation Error (CWE-346) vulnerability in Legacyupdate (inferred from references). Its CVSS base score is 9.9 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Steganography (T1001.002); ranked at the 11th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SA-11 (Developer Testing and Evaluation) and SI-6 (Security and Privacy Function Verification) — see the control section below for these in your framework.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-100662
Vulnerability Data
Legacy Update is a tool for activating and installing updates on legacy Windows PCs. Legacy Update 1.12.0 through 1.13.1 contains an origin validation error in the IsPermitted method of its ActiveX control. After successfully reading the hosting document's hostname, a…
more
hostname that is not on the permitted list falls through without setting E_ACCESSDENIED, causing IsPermitted to return S_OK. An attacker who induces a user to visit a malicious webpage in Internet Explorer can invoke the control to enumerate update and system information, install updates without consent, display dialogs, or restart the computer when a reboot is pending. This issue was fixed in Legacy Update 1.13.2.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Developer testing and evaluation at post-design stages directly exercises code paths and can identify functions returning incorrect status codes.
Verification of correct security/privacy function operation will surface incorrect status codes that alter expected behavior.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices such as code review, unit testing, and static analysis directly prevent incorrect status codes from being returned.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Network security controls enforce origin validation at network boundaries.
Security of network services includes validating the authenticity of service endpoints.
Secure development lifecycle includes code review and testing that can catch incorrect status codes.
A.8.26 requires identifying and specifying requirements for resilience against malicious attacks including SQL injections and input validation (items d, j), plus related protections (authentication, segregation, cryptography per 8.24), which can address some but not most origin validation scenarios such as those involving untrusted cross-origin requests or implicit trust in sources.
A.8.27 mandates security-by-design principles (defense-in-depth, least privilege, assume-breach, distrust-external-input, zero-trust verification) plus design reviews that can catch and block origin-validation gaps in many common cases, but leaves a bounded remainder (e.g. protocol-level or third-party component origin errors not surfaced by the organization's review process).
Hardening callouts derived
DISA STIG baselines are authored against specific weaknesses. Where this CVE cites a broad weakness class, the mapping is not asserted at that abstraction (owner ruling, 2026-09-25: grade only at Base and below), so no rule is shown here rather than a rule shown against the wrong grain.
- No fine-grained STIG row for CWE-346, a class-level weakness, and none of its children carries one either.