CVE-2026-110632 Report One MyReport Updater through 2.1.1 Unauthenticated gRPC Service RCE
Unauthenticated gRPC service allows attackers to redirect the updater to malicious servers, achieving remote code execution as SYSTEM.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-110632?
CVE-2026-110632 is a critical missing authorization vulnerability in MyReport Updater, published on 14 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Report One MyReport Updater through 2.1.1 exposes an unauthenticated gRPC service on TCP port 9095 that allows remote attackers to redirect the SYSTEM updater by invoking the UpdateConfigReferent method. Attackers can point the updater to a malicious reference server serving modified module archives with matching MD5 digests to write files and execute code as SYSTEM.
Weakness: CWE-306
Which versions are affected by CVE-2026-110632?
How do I fix CVE-2026-110632?
No fix has been published for CVE-2026-110632 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-110632 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-110632 exists.
Sources
Also known as GHSA-c58m-4p4j-mrrh.