MyReport Updater Flaw Lets Attackers Run Code as SYSTEM Before Patch

Report One MyReport Updater through version 2.1.1 contains a critical security flaw that exposes an unauthenticated gRPC service on TCP port 9095. According to the National Vulnerability Database, this vulnerability, tracked as CVE-2026-110632, carries a CVSS score of 9.2. Attackers can exploit this exposure to redirect the SYSTEM updater by invoking the UpdateConfigReferent method. This allows them to point the updater to a malicious reference server.

How it unfolded

• The National Vulnerability Database published a record for CVE-2026-110632 detailing the flaw in Report One MyReport Updater.
• The record identifies CWE-306 as the underlying weakness, indicating a failure to properly authenticate during a critical operation.
• The vulnerability description specifies that attackers can serve modified module archives with matching MD5 digests to write files and execute code.

Who is affected

Organisations using Report One MyReport Updater through version 2.1.1 are directly affected by this vulnerability. The flaw allows remote attackers to redirect the SYSTEM updater by invoking the UpdateConfigReferent method. This high-privilege access enables attackers to write files and run arbitrary commands on the host machine. The exposure occurs via the gRPC service listening on TCP port 9095. Any instance of the updater accessible to unauthenticated network traffic is at risk of being hijacked to download and execute malicious module archives.

Our take on the response

The severity of this vulnerability is underscored by its CVSS score of 9.2 and the ability to execute code as SYSTEM. The lack of authentication on the gRPC service creates a direct path for remote exploitation. The vulnerability allows attackers to point the updater to a malicious reference server serving modified module archives with matching MD5 digests. This mechanism enables the writing of files and execution of code as SYSTEM. The absence of a confirmed patch means organisations must rely on network controls to mitigate the risk immediately.

Who needs to act first

Teams should prioritise systems where the MyReport Updater service is exposed to untrusted networks. Check whether TCP port 9095 is accessible from the internet or guest networks. If a fix is not yet available, isolate affected hosts from general network traffic to prevent exploitation. Verify that internal segmentation rules block unauthorised access to this specific port. Monitor logs for unusual outbound connections that might indicate the updater is contacting a malicious reference server. Backup critical configuration files before making any network changes to ensure recovery options remain available.

What to do and how to stay safe: Report One

• Block inbound traffic to TCP port 9095 at the firewall to prevent unauthenticated access to the gRPC service.
• Isolate hosts running Report One MyReport Updater from networks where untrusted users can reach them.
• Monitor network logs for unexpected outbound connections from the updater service that may indicate exploitation.
• Verify that no modified module archives have been written to the system by checking file integrity baselines.

Step-by-step guide: Vulnerability Prioritization: How to Rank Risks Without Wasting Time

General security guidance from the Patch Observer newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which versions of Report One MyReport Updater are vulnerable?

Versions through 2.1.1 are affected by CVE-2026-110632.

Is there a patch available for this vulnerability?

No fix has been confirmed yet for this critical vulnerability.

What is the CVSS score for CVE-2026-110632?

The National Vulnerability Database rates it as 9.2 Critical.