CVE-2026-110632 in MyReport Updater
Summary
by MITRE • 10/15/2026
Report One MyReport Updater through 2.1.1 exposes an unauthenticated gRPC service on TCP port 9095 that allows remote attackers to redirect the SYSTEM updater by invoking the UpdateConfigReferent method. Attackers can point the updater to a malicious reference server serving modified module archives with matching MD5 digests to write files and execute code as SYSTEM.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/15/2026
The vulnerability identified in MyReport Updater versions through 2.1.1 represents a critical security flaw stemming from an improperly secured remote procedure call interface. Specifically, the application exposes a gRPC service on TCP port 9095 without implementing any form of authentication or access control mechanisms. This configuration error allows unauthenticated external actors to interact directly with the updater component via network requests. The core technical issue lies in the lack of validation for incoming update instructions, which permits remote attackers to manipulate the behavior of the system-level updater process by invoking the UpdateConfigReferent method.
From a technical perspective, this flaw enables an attacker to redirect the updater's configuration reference toward a malicious server controlled by the adversary. The vulnerability exploits the trust relationship between the updater and its designated source for module archives. By supplying a crafted URL or endpoint within the UpdateConfigReferent call, the attacker instructs the system to fetch update packages from their own infrastructure rather than the legitimate vendor repository. This redirection is possible because the application does not verify the identity of the client making the request nor does it validate that the source of the update has been authorized by an administrator or signed with a trusted certificate before proceeding with the download and installation process.
The operational impact of this vulnerability is severe, as it leads to arbitrary code execution with SYSTEM-level privileges on the affected host. Once the updater retrieves the malicious module archive from the attacker's server, it proceeds to install it under the assumption that it is a legitimate update. The description notes that attackers can serve modified archives with matching MD5 digests, which suggests either a weakness in integrity verification mechanisms or an ability to forge signatures if cryptographic checks are bypassed or misconfigured. Upon execution, these malicious modules run within the context of the SYSTEM account, granting the attacker full control over the operating system. This level of access allows for complete compromise of confidentiality, integrity, and availability, including the installation of persistent backdoors, data exfiltration, lateral movement across the network, and modification or destruction of critical system files.
This vulnerability aligns with CWE-287, which describes Improper Authentication, as the service fails to verify the identity of users before granting access to sensitive functionality. Furthermore, it maps to MITRE ATT&CK technique T1059 Command and Scripting Interpreter through the execution of malicious modules, and potentially T1195 Supply Chain Compromise if the attacker leverages trusted update mechanisms to distribute malware. The exploitation path also reflects aspects of CWE-74 Improper Neutralization Special Elements in Output Used by a Downstream Component, where untrusted input (the redirect URL) is processed without adequate sanitization or validation.
To mitigate this risk, immediate remediation should focus on restricting access to the gRPC service on port 9095. Network-level controls such as firewall rules should be implemented to ensure that only authorized management stations can communicate with this interface. Additionally, implementing mutual TLS authentication for all gRPC connections is essential to verify both client and server identities before allowing any method invocation. From a software development perspective, the UpdateConfigReferent function must enforce strict input validation and require administrative credentials or digital signatures from trusted sources before altering update configurations. Upgrading to a patched version of MyReport that addresses these authentication gaps is critical for restoring security posture.