CVE-2026-110632: Report One MyReport Updater through 2.1.1 Unauthenticated gRPC Service RCE
Report One MyReport Updater through 2.1.1 exposes an unauthenticated gRPC service on TCP port 9095 that allows remote attackers to redirect the SYSTEM updater by invoking the UpdateConfigReferent method. Attackers can point the updater to a malicious reference server serving modified module archives with matching MD5 digests to write files and execute code as SYSTEM.
Affected Software
Event History
Frequently Asked Questions
Which systems are exposed to remote exploitation?
Systems running Report One MyReport Updater through version 2.1.1 are exposed if the unauthenticated gRPC service on TCP port 9095 is reachable by a remote attacker.
What does an attacker need to exploit this issue?
The attacker needs network access to TCP port 9095. No authentication or user interaction is required, but exploitation requires redirecting the updater to an attacker-controlled reference server that provides modified module archives with matching MD5 digests.
What level of access can successful exploitation provide?
Successful exploitation can write files and execute code as SYSTEM because the attacker can redirect the SYSTEM updater using the UpdateConfigReferent method.
What can be done while a patch is unavailable?
Restrict network access to TCP port 9095 so untrusted remote systems cannot reach the updater's gRPC service.