CVE-2026-110633

MyReport Updater arbitrary file installation and privilege escalation

MyReport Updater 2.1.1 and below allowed a low-privileged user to control the reference server and installation directory through UpdaterManager.exe over gRPC. The SYSTEM updater service installed attacker-supplied archives into arbitrary directories, enabling DLL planting and escalation to SYSTEM.

Vendor

Report One

Product

MyReport Updater

Component

UpdaterService.exe / UpdaterManager.exe

Disclosure

Oct 13, 2026

Bug class

CWE-269, improper privilege management

Severity

High (CVSS 3.1: 7.8)