CVE-2026-110632: critical vulnerability in Report One MyReport Updater
Report One MyReport Updater through 2.1.1 Unauthenticated gRPC Service RCE
Published
48Vexday Risk Score
No sign of exploitation. It has a public proof of concept.
ssvc Attendcvss 9.2epss 0.6%
exploitation probability
0.6%top 50% of all CVEs
observed exploitation
nono source reports it
1 public exploit(s)
Report One MyReport Updater through 2.1.1 exposes an unauthenticated gRPC service on TCP port 9095 that allows remote attackers to redirect the SYSTEM updater by invoking the UpdateConfigReferent method. Attackers can point the updater to a malicious reference server serving modified module archives with matching MD5 digests to write files and execute code as SYSTEM.
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Affected products
Report One · MyReport Updaterpublic PoCs found — 1
cve_referenceblog.quarkslab.com/myreport-updater-from-grpc-to-system.htmlunverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Report One MyReport Updater
In the same product, most dangerous first.