CVE Feed

    Dashboard / CVE / CVE-2026-110632

    CVE-2026-110632

    Report One MyReport Updater through 2.1.1 exposes an unauthenticated gRPC service on TCP port 9095 that allows remote attackers to redirect the SYSTEM updater by invoking the UpdateConfigReferent method. Attackers can point the updater to a malicious reference server serving modified module archives with matching MD5 digests to write files and execute code as SYSTEM.

    Published:Oct 14, 2026
    Last Modified:Oct 26, 2026
    EPS:Oct 14, 2026
    EPSS Score:0.00672
    CVSS Score:8.1

    Affected Products

    Vendor
    Report One
    Product
    Myreport Updater

    Exploits

    No exploit reference

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High