CVE-2026-110632 Report One CVE debrief

Who should care

Defenders and administrators of MyReport Updater installations should assess exposure and apply patches or mitigations. This vulnerability affects operators of MyReport Updater, platform administrators, and security teams responsible for vulnerability management. The vulnerability has a high CVSS score and defenders should prioritize patching or mitigating this vulnerability. Security teams should review the CVE record and NVD details to understand the vul

Why it matters

CVE-2026-110632 is a critical vulnerability in Report One MyReport Updater through 2.1.1, allowing unauthenticated RCE via gRPC service. Defenders should assess exposure and apply patches or mitigations.

• Potential for unauthenticated RCE
• Exposure of sensitive systems and data
• Need for immediate patching or mitigation
• Potential for lateral movement and escalation

Technical summary

Report One MyReport Updater through 2.1.1 exposes an unauthenticated gRPC service on TCP port 9095, allowing remote attackers to execute code as SYSTEM by invoking the UpdateConfigReferent method. Attackers can point the updater to a malicious reference server serving modified module archives with matching MD5 digests to write files and execute code as SYSTEM. This vulnerability allows for unauthenticated remote code execution and defenders should assess exposure and apply patches or mitigations immediately. The vulnerability is a result of the unauthenticated gRPC service and the lack of proper validation of the updater's configuration.

Defensive priority

High priority for defenders to assess exposure and apply patches

Recommended defensive actions

• Assess exposure of MyReport Updater installations
• Apply patches or mitigations for vulnerable versions
• Monitor for potential exploitation attempts
• Review compensating controls for exposed systems
• Check relevant monitoring, detection, and logs for exposed assets
• Track exceptions, retest remediated assets
• Confirm whether affected product deployments exist in managed environments

Evidence notes

The CVE record and NVD details provide information on the vulnerability. Limited information is available on affected versions beyond 2.1.1. The vulnerability has been publicly disclosed and defenders should assess exposure. No additional information is available on potential exploits or attacks. The CVE Program and NVD records provide the most accurate and up-to-date information.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.