CVE-2026-110632

MyReport Updater unauthenticated gRPC remote code execution

MyReport Updater 2.1.1 and below exposed an unauthenticated gRPC service on TCP port 9095. Remote attackers could invoke UpdateConfigReferent to redirect the SYSTEM updater to a malicious reference server, serving modified module archives with matching MD5 digests to write files and execute code as SYSTEM.

Vendor

Report One

Product

MyReport Updater

Component

UpdaterService.exe / gRPC UpdateConfigReferent

Disclosure

Oct 13, 2026

Bug class

CWE-306, missing authentication for critical function

Severity

High (CVSS 3.1: 8.1)