Vulnerability details
CVE-2026-110632
Report One MyReport Updater
Report One MyReport Updater through 2.1.1 Unauthenticated gRPC Service RCE
CVSS 4.0
9.2Critical
Official description
Report One MyReport Updater through 2.1.1 exposes an unauthenticated gRPC service on TCP port 9095 that allows remote attackers to redirect the SYSTEM updater by invoking the UpdateConfigReferent method. Attackers can point the updater to a malicious reference server serving modified module archives with matching MD5 digests to write files and execute code as SYSTEM.
CVSS scores
| Score | Version | Source | Vector |
|---|---|---|---|
| 9.2Critical | 4.0 | CVEProject cvelistV5 (CNA) (VulnCheck) | CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N |
| 8.1High | 3.1 | CVEProject cvelistV5 (CNA) (VulnCheck) | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H |
Affected products
| Vendor | Product | Versions | Source |
|---|---|---|---|
| Report One | MyReport Updater | v ≤ 2.1.1 | CVEProject cvelistV5 (CNA) |
References and advisories
3- https://blog.quarkslab.com/myreport-updater-from-grpc-to-system.html third-party-advisorytechnical-descriptionexploit
- https://www.myreport.fr/myreport/ product
- https://www.vulncheck.com/advisories/report-one-myreport-updater-through-2.1.1-unauthenticated-grpc-service-rce third-party-advisory
Kolun on Telegram @kolunsec
Exploited CVEs, key news and a daily digest
Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.
Details
- Published
- 2026-10-14
- Last updated
- 2026-10-14
- State
- Published
- Assigner (CNA)
- VulnCheck
- Kolun priority
- 37 · Medium
Exploit prediction (EPSS)
0.67%
Probability of exploitation in 30 days
52.3%
Percentile (among all CVEs)
SSVC assessment (CISA)
- Automatable
- No
- Exploitation
- Proof of concept
- Technical impact
- Total
Weaknesses (CWE)
- CWE-306Missing Authentication for Critical Function