CVE-2026-110633

7.8High

Published 14 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash

7.8High

Attack vector: Local
Complexity: Low
Privileges needed: Low
User interaction: None
Impact: Full C/I/A compromise
Weakness: CWE-269

Impact

A local attacker with low-privileged access can gain full SYSTEM privileges on the machine. They achieve this by instructing the MyReport Updater service to unpack a malicious archive into an arbitrary directory.

Root cause

The gRPC service exposed by the SYSTEM-level updater allows unprivileged users to define custom update reference servers and extraction destinations without proper privilege separation.

Affected systems

MyReport Updater through 2.1.1

CVSS v3.1 · CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Fix & remediation

Upgrade to a version newer than 2.1.1 if provided by the vendor. If an update cannot be deployed immediately, stop and disable the MyReport Updater Windows service.

shell

$ Stop-Service -Name "MyReportUpdater" -PassThru | Set-Service -StartupType Disabled

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

MyReport Updater through 2.1.1 contains a local privilege escalation vulnerability that allows low-privileged users to make the SYSTEM updater service install attacker-supplied archives into arbitrary directories. Attackers can use UpdaterManager.exe over gRPC to set a malicious reference server and installLocation, planting a DLL like HID.dll loaded by osk.exe to gain SYSTEM privileges.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-110633