Local Privilege Escalation in MyReport Updater

Executive Summary

CVE-2026-110633 is a local privilege escalation flaw in MyReport Updater through version 2.1.1. It allows low-privileged users to exploit the SYSTEM updater service via UpdaterManager.exe over gRPC. Attackers can set a malicious reference server and installLocation to plant a DLL like HID.dll in a directory where osk.exe loads it, granting SYSTEM privileges.

Useful 0 Not Useful 0

Detection Guidance

Check if the MyReport Updater service (UpdaterManager.exe) is running and listening on TCP port 9095. Use commands like 'netstat -ano | findstr 9095' or 'Get-NetTCPConnection -LocalPort 9095' to verify. Inspect gRPC traffic for unauthorized remote calls to methods like UpdateConfigReferent.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability enables attackers with standard user privileges to escalate to SYSTEM privileges on affected systems. They can execute arbitrary code as NT AUTHORITY\SYSTEM, potentially taking full control of the machine, installing malware, or accessing sensitive data.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows low-privileged users to escalate privileges to SYSTEM level by exploiting the MyReport Updater service. This could lead to unauthorized access to sensitive data, system compromise, or installation of malware, which may violate compliance requirements under GDPR (data protection) and HIPAA (healthcare data security) by exposing or altering protected information without authorization.

Useful 0 Not Useful 0

Mitigation Strategies

Update MyReport Updater to the latest version beyond 2.1.1. Disable the gRPC service on TCP port 9095 if not required. Restrict network access to the service using firewalls. Monitor for suspicious DLL placements in directories loaded by privileged processes like osk.exe.

Useful 0 Not Useful 0