CVE-2026-110633

HIGH 7.8

MyReport Updater through 2.1.1 Local Privilege Escalation via Updater Service

CVSS Score

7.8

EPSS Score

0.0%

EPSS Percentile

0th

MyReport Updater through 2.1.1 contains a local privilege escalation vulnerability that allows low-privileged users to make the SYSTEM updater service install attacker-supplied archives into arbitrary directories. Attackers can use UpdaterManager.exe over gRPC to set a malicious reference server and installLocation, planting a DLL like HID.dll loaded by osk.exe to gain SYSTEM privileges.

CWE	CWE-269
Vendor	report one
Product	myreport updater
Published	Oct 14, 2026

Stay Ahead of the Next One

Get instant alerts for report one myreport updater

Be the first to know when new high vulnerabilities affecting report one myreport updater are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Affected Versions

Report One / MyReport Updater

0 ≤ 2.1.1

References

NVD ↗ CVE.org ↗ EPSS Data ↗

blog.quarkslab.com: https://blog.quarkslab.com/myreport-updater-from-grpc-to-system.html myreport.fr: https://www.myreport.fr/myreport/ vulncheck.com: https://www.vulncheck.com/advisories/myreport-updater-through-2.1.1-local-privilege-escalation-via-updater-service

Credits

Lucas Laise of Quarkslab