CVE-2026-110633

HighCVSS 7.8

Published: 14/10/2026(UTC)Updated: 16/10/2026(UTC)Translated: 14/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.14%

3th percentile - higher than 3% of all known CVEs

Summary

MyReport Updater through 2.1.1 contains a local privilege escalation vulnerability. Low-privileged users can make the SYSTEM updater service install attacker-supplied archives into arbitrary directories, planting a DLL like HID.dll loaded by osk.exe to gain SYSTEM privileges.

Risk Assessment

An attacker can gain SYSTEM privileges, leading to full system control and arbitrary code execution.

Recommendation

Update MyReport Updater to a version later than 2.1.1 and restrict access to the updater service and gRPC interface.

Other vulnerabilities in MyReport Updater

CVE-2026-110632High
Report One MyReport Updater through 2.1.1 exposes an unauthenticated gRPC service on TCP port 9095. Remote attackers can redirect the SYSTEM updater by invoking the UpdateConfigReferent method and pointing it to a malicious reference server.

Original NVD description (English source)

MyReport Updater through 2.1.1 contains a local privilege escalation vulnerability that allows low-privileged users to make the SYSTEM updater service install attacker-supplied archives into arbitrary directories. Attackers can use UpdaterManager.exe over gRPC to set a malicious reference server and installLocation, planting a DLL like HID.dll loaded by osk.exe to gain SYSTEM privileges.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS