CVE-2026-110632
8.1HighPublished 14 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
- Impact
- Full C/I/A compromise
- Weakness
- CWE-306
Impact
Remote, unauthenticated attackers can execute arbitrary code as SYSTEM by redirecting update sources. They only need network reachability to the exposed updater port.
Root cause
The updater exposes an unauthenticated gRPC service that permits arbitrary reconfiguration of the reference update server via the UpdateConfigReferent method.
Affected systems
Report One MyReport Updater through 2.1.1
CVSS v3.1 · CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Fix & remediation
Upgrade to a version newer than 2.1.1 once provided by the vendor. In the interim, block inbound traffic to TCP port 9095 on host and perimeter firewalls or stop the updater service.
$ netsh advfirewall firewall add rule name="Block MyReport Updater gRPC" dir=in action=block protocol=TCP localport=9095AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
Report One MyReport Updater through 2.1.1 exposes an unauthenticated gRPC service on TCP port 9095 that allows remote attackers to redirect the SYSTEM updater by invoking the UpdateConfigReferent method. Attackers can point the updater to a malicious reference server serving modified module archives with matching MD5 digests to write files and execute code as SYSTEM.