HIGH 8.5 NVD
CVE-2026-110633
MyReport Updater through 2.1.1 contains a local privilege escalation vulnerability that allows low-privileged users to make the SYSTEM updater service install a
MyReport Updater through 2.1.1 contains a local privilege escalation vulnerability that allows low-privileged users to make the SYSTEM updater service install attacker-supplied archives into arbitrary directories. Attackers can use UpdaterManager.exe over gRPC to set a malicious reference server and installLocation, planting a DLL like HID.dll loaded by osk.exe to gain SYSTEM privileges.
References
- https://blog.quarkslab.com/myreport-updater-from-grpc-to-system.html
- https://www.myreport.fr/myreport/
- https://www.vulncheck.com/advisories/myreport-updater-through-2.1.1-local-privilege-escala
This high severity vulnerability with a CVSS score of 8.5 was published on 2026-10-14 via NVD.
vulnfeed aggregates 14864 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.