CVE-2026-110632

HighCVSS 8.1

Published: 14/10/2026(UTC)Updated: 15/10/2026(UTC)Translated: 14/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Elevated risk

0.65%

50th percentile - higher than 50% of all known CVEs

Summary

Report One MyReport Updater through 2.1.1 exposes an unauthenticated gRPC service on TCP port 9095. Remote attackers can redirect the SYSTEM updater by invoking the UpdateConfigReferent method and pointing it to a malicious reference server.

Risk Assessment

An attacker can write files and execute code as SYSTEM, leading to full system compromise.

Recommendation

Update MyReport Updater to a version later than 2.1.1 and secure the gRPC service with authentication and network access restrictions.

Other vulnerabilities in MyReport Updater

CVE-2026-110633High
MyReport Updater through 2.1.1 contains a local privilege escalation vulnerability. Low-privileged users can make the SYSTEM updater service install attacker-supplied archives into arbitrary directories, planting a DLL like HID.dll loaded by osk.exe to gain SYSTEM privileges.

Original NVD description (English source)

Report One MyReport Updater through 2.1.1 exposes an unauthenticated gRPC service on TCP port 9095 that allows remote attackers to redirect the SYSTEM updater by invoking the UpdateConfigReferent method. Attackers can point the updater to a malicious reference server serving modified module archives with matching MD5 digests to write files and execute code as SYSTEM.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS