Unauthenticated gRPC Service in MyReport Updater Exposes Vulnerability
CVE-2026-110632

9.2CRITICAL

Key Information:

Vendor

Report One

Status
Myreport Updater
Vendor
CVE Published:
14 October 2026

Badges

👾 Exploit Exists

What is CVE-2026-110632?

The MyReport Updater exposes an unauthenticated gRPC service on TCP port 9095, allowing remote attackers to exploit the UpdateConfigReferent method. This vulnerability could be leveraged to redirect the SYSTEM updater to a malicious server, where attackers can serve modified module archives that match legitimate MD5 digests. By doing so, they can gain unauthorized access, write files, and execute arbitrary code with SYSTEM privileges, significantly compromising security.

Affected Version(s)

MyReport Updater 0 <= 2.1.1

References

https://blog.quarkslab.com/myreport-updater-from-grpc-to-...
third-party-advisorytechnical-descriptionexploit
https://www.myreport.fr/myreport/
product
https://www.vulncheck.com/advisories/report-one-myreport-...
third-party-advisory

CVSS V4

Score:
9.2
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Lucas Laise of Quarkslab
.