Unauthenticated gRPC UpdateConfigReferent Code Execution in MyReport Updater

Executive Summary

CVE-2026-110632 is a critical vulnerability in Report One MyReport Updater through version 2.1.1. It exposes an unauthenticated gRPC service on TCP port 9095 that allows remote attackers to redirect the SYSTEM updater by invoking the UpdateConfigReferent method. Attackers can point the updater to a malicious server serving modified module archives with matching MD5 digests, enabling them to write files and execute code as SYSTEM.

Useful 0 Not Useful 0

Detection Guidance

Check if TCP port 9095 is open and listening on your system using commands like 'netstat -ano | findstr 9095' or 'ss -tulnp | grep 9095'. Scan for unauthenticated gRPC services on port 9095 using tools like nmap with 'nmap -p 9095 --script gprc-enum <target>'.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows remote attackers to execute arbitrary code with SYSTEM privileges on affected systems. An attacker could gain full control over the machine, install malware, steal data, or perform other malicious actions. The flaw enables unauthenticated remote code execution, meaning no user interaction is required for exploitation.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to severe compliance violations under GDPR and HIPAA due to unauthorized SYSTEM-level access. It may result in data breaches, loss of sensitive information, and failure to meet security requirements for protecting personal or health data. Organizations using affected versions may face regulatory penalties and reputational damage.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately block external access to TCP port 9095 using a firewall. Disable the gRPC service if not required. Update MyReport Updater to the latest patched version if available. Monitor network traffic for suspicious connections to port 9095.

Useful 0 Not Useful 0