CVE-2026-110632

HIGH 8.1

Report One MyReport Updater through 2.1.1 Unauthenticated gRPC Service RCE

CVSS Score

8.1

EPSS Score

0.0%

EPSS Percentile

0th

Report One MyReport Updater through 2.1.1 exposes an unauthenticated gRPC service on TCP port 9095 that allows remote attackers to redirect the SYSTEM updater by invoking the UpdateConfigReferent method. Attackers can point the updater to a malicious reference server serving modified module archives with matching MD5 digests to write files and execute code as SYSTEM.

CWE	CWE-306
Vendor	report one
Product	myreport updater
Published	Oct 14, 2026
Last Updated	Oct 14, 2026

Stay Ahead of the Next One

Get instant alerts for report one myreport updater

Be the first to know when new high vulnerabilities affecting report one myreport updater are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Affected Versions

Report One / MyReport Updater

0 ≤ 2.1.1

References

NVD ↗ CVE.org ↗ EPSS Data ↗

blog.quarkslab.com: https://blog.quarkslab.com/myreport-updater-from-grpc-to-system.html myreport.fr: https://www.myreport.fr/myreport/ vulncheck.com: https://www.vulncheck.com/advisories/report-one-myreport-updater-through-2.1.1-unauthenticated-grpc-service-rce

Credits

Lucas Laise of Quarkslab