CRITICAL 9.2 NVD
CVE-2026-110632
Report One MyReport Updater through 2.1.1 exposes an unauthenticated gRPC service on TCP port 9095 that allows remote attackers to redirect the SYSTEM updater b
Report One MyReport Updater through 2.1.1 exposes an unauthenticated gRPC service on TCP port 9095 that allows remote attackers to redirect the SYSTEM updater by invoking the UpdateConfigReferent method. Attackers can point the updater to a malicious reference server serving modified module archives with matching MD5 digests to write files and execute code as SYSTEM.
References
- https://blog.quarkslab.com/myreport-updater-from-grpc-to-system.html
- https://www.myreport.fr/myreport/
- https://www.vulncheck.com/advisories/report-one-myreport-updater-through-2.1.1-unauthentic
This critical severity vulnerability with a CVSS score of 9.2 was published on 2026-10-14 via NVD.
Risk Timeline
CVE Disclosed2026-10-14 · -1 days ago
Remediation Resources
Official Advisory
blog.quarkslab.com/myreport-updater-from-grpc-to-system.htmlAnalysis & PoC
www.myreport.fr/myreport/
vulnfeed aggregates 14864 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.