CVE-2026-110632

HIGHCVSS 8.1

Description

Report One MyReport Updater through 2.1.1 exposes an unauthenticated gRPC service on TCP port 9095 that allows remote attackers to redirect the SYSTEM updater by invoking the UpdateConfigReferent method. Attackers can point the updater to a malicious reference server serving modified module archives with matching MD5 digests to write files and execute code as SYSTEM.

Timeline

Published:October 14th, 2026 3:17 PM

Last modified:October 15th, 2026 2:47 PM

CVSS Scoring

CVSS v3: 8.1 (HIGH)

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

CWE-306

References & Reports

Advisories, patches, and third-party reports

https://blog.quarkslab.com/myreport-updater-from-grpc-to-system.html
https://www.myreport.fr/myreport/
https://www.vulncheck.com/advisories/report-one-myreport-updater-through-2.1.1-unauthenticated-grpc-service-rce

Source: NIST NVD · Data may lag official sources by up to one minute