CVE-2026-110632
Last modified
CVE-2026-110632 is a high-severity vulnerability rated 8.1/10 on the CVSS scale. Report One MyReport Updater through 2.1.1 exposes an unauthenticated gRPC service on TCP port 9095 that allows remote attackers to redirect the SYSTEM updater by invoking the UpdateConfigReferent method. Attackers can point the updater to a malicious reference server serving modified module archives with matching MD5 digests to write files and execute code as SYSTEM.. EPSS estimates a 0.65% chance of exploitation in the next 30 days.
Description
Report One MyReport Updater through 2.1.1 exposes an unauthenticated gRPC service on TCP port 9095 that allows remote attackers to redirect the SYSTEM updater by invoking the UpdateConfigReferent method. Attackers can point the updater to a malicious reference server serving modified module archives with matching MD5 digests to write files and execute code as SYSTEM.
Metrics
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| Report One | MyReport Updater | <= 2.1.1 |
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2026-110632?
How severe is CVE-2026-110632?
How do I fix CVE-2026-110632?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-110627ClipBucket v5 through 5.5.3-#206 contains a reflected cross-…4.7
- CVE-2026-110628Kan 0.5.5 through 0.6.0 contains an unauthenticated server-s…8.6
- CVE-2026-110629VentureDrake Laravel CRM before 2.4.0 contains a missing aut…6.5
- CVE-2026-11063Insufficient validation of untrusted input in WebNN in Googl…9.6
- CVE-2026-110630VentureDrake Laravel CRM before 2.4.0 contains an incorrect …6.5
- CVE-2026-110631Komodo through 2.3.3 contains an authentication bypass vulne…9.8
- CVE-2026-110633MyReport Updater through 2.1.1 contains a local privilege es…7.8
- CVE-2026-110634git-diff before 2.0.7 contains an OS command injection vulne…9.8
- CVE-2026-110635webp-converter before 3.0.0 contains an OS command injection…9.8
- CVE-2026-110636pypdftk through 0.5 contains an OS command injection vulnera…9.8
- CVE-2026-110637buildebooks before 0.2.2 contains an OS command injection vu…7.8
- CVE-2026-110638doc-recog through 1.1.6 contains an OS command injection vul…9.8
Are you affected by CVE-2026-110632?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST