Report One MyReport Updater: Unauthenticated gRPC service allows remote code execution
Summary
MyReport Updater through 2.1.1 exposes an unauthenticated gRPC service on TCP port 9095 that runs with SYSTEM privileges. A remote attacker can call the UpdateConfigReferent method to point the updater to a malicious reference server, which can deliver modified module archives with matching MD5 digests. Successful exploitation allows writing files and executing code as SYSTEM, provided the service can reach the attacker's server over gRPC.
Affected
- Report One MyReport Updater, versions 0 to 2.1.1 (per CVE record)
Fixed in
Unknown.
Workaround
- No vendor-published workaround known.
- Restrict TCP port 9095 with host and network firewalls to the minimum necessary hosts.
- Remove the Updater from hosts where MyReport is not needed.
Exploitation
- Quarkslab published a technical write-up of the attack chain; no exploit code found in our research.
- No in-the-wild exploitation found.
- CISA SSVC: exploitation status 'poc', automatable: no, technical impact: total.
- EPSS: 0.00649 (about 0.65%).
Our recommendation
- Confirm whether MyReport Updater is installed and which version is running.
- Restrict access to TCP port 9095 now, and block egress from the Updater to untrusted servers.
- Monitor for unexpected gRPC connections on port 9095.
- Ask Report One for a fixed version and apply it as soon as it is available.
- Also review CVE-2026-110633, a local privilege escalation in the same product.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Quarkslab: MyReport Updater: From gRPC to SYSTEM blog.quarkslab.com
- VulnCheck advisory: Report One MyReport Updater through 2.1.1 www.vulncheck.com
- Vulners: CVE-2026-110632 vulners.com
- Strix: CVE-2026-110632 www.strix.ai
- MyReport (vendor website) www.myreport.fr
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 04:35.
Original description (NVD)
Report One MyReport Updater through 2.1.1 exposes an unauthenticated gRPC service on TCP port 9095 that allows remote attackers to redirect the SYSTEM updater by invoking the UpdateConfigReferent method. Attackers can point the updater to a malicious reference server serving modified module archives with matching MD5 digests to write files and execute code as SYSTEM.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.