External risk intelligence

Report One MyReport Updater SYSTEM Updater Remote Code Execution

CVE advisorySeverity: CRITICAL (CVSS 9.2)

CVE-2026-110632

The vulnerability involves an unauthenticated gRPC service running on a specific TCP port. While network-reachable, such services are typically intended for internal administrative or inter-service communication rather than public-facing exposure. Public internet reachability is possible in misconfigured deployments but is not the standard or intended deployment pattern for this type of updater service.

Missing Authentication

Halo Surface Signal: 3 out of 5 — possibly public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in the MyReport Updater software, specifically affecting how system updates are managed. This flaw allows remote attackers to potentially redirect the update process to a malicious server, enabling the execution of arbitrary code with elevated system privileges. The main concern is confirming whether this specific updater service is exposed externally and, if so, its potential impact.

Unauthenticated updater control allows code execution.
Critical vulnerability could compromise system integrity.
Confirm relevance and exposure of updater service.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this by leveraging an unauthenticated gRPC service that exposes a method to modify the system updater's configuration. This service, running on TCP port 9095, allows remote attackers to redirect the updater to a malicious server. By providing specially crafted module archives with matching MD5 digests, an attacker could achieve arbitrary file writes and subsequently execute code with SYSTEM privileges.

Unauthenticated network service exposure.
Remotely controllable updater configuration.
Arbitrary file write and code execution.

Live Threat

Current exploitation, exposure, and threat context

The unauthenticated gRPC service exposes a SYSTEM updater, which attackers could manipulate to redirect to a malicious server. This server could then serve modified module archives, potentially allowing for unauthorized file writes and code execution with SYSTEM privileges when supported by the advisory.

SYSTEM updater and its modules.
Remote redirection over network.
Unauthorized file writes and code execution.

Operational Fix

Recommended remediation, mitigation, and detection steps

The vendor, application owners, and infrastructure teams are most likely responsible for addressing this vulnerability, as it impacts an updater service. The initial step is to identify all instances of the affected updater technology, determine their network reachability and business criticality, and then confirm the accountable owner before planning remediation.

Identify affected updater instances.
Verify external reachability and criticality.
Plan remediation based on confirmed ownership.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is MyReport Updater?

MyReport Updater is a component within the MyReport software suite designed to manage and apply system updates. It automates the retrieval and installation of module archives to keep the software current. By design, it includes a gRPC service on TCP port 9095 to handle these update configurations, ensuring the application can communicate with update servers to maintain operational integrity.

What does CWE-306 mean for CVE-2026-110632?

CWE-306, or Missing Authentication for Critical Function, means that a sensitive service fails to verify who is requesting an action. In this case, the updater's gRPC service allows anyone to call the UpdateConfigReferent method without providing credentials. This allows an unauthorized party to change where the updater looks for its files, effectively bypassing the security controls intended to keep the update process legitimate.

How does an attacker trigger this vulnerability?

An attacker triggers this by connecting to the gRPC service on port 9095 and sending a request to redirect the updater to a malicious server. The vulnerability requires the ability to provide specific module archives that match required MD5 digests to gain code execution. It is not triggered by simple network noise or accidental traffic, as the attacker must successfully orchestrate a redirection and provide a crafted file that passes the updater's checksum validation.

Do I need to worry if my service is internal?

Halo Surface Signal indicates that while the service is network-reachable, it is typically intended for internal administrative use, not public exposure. If your instance is strictly internal and protected from the open internet, the risk is reduced compared to deployments that are misconfigured to be public-facing. You should still verify your network access controls to ensure this port is not inadvertently reachable from untrusted networks.

How should I respond to this threat?

First, perform an internal audit to identify all systems running the MyReport Updater. Once identified, verify if the gRPC service on port 9095 is exposed to the internet or unauthorized network segments. If exposure is found, restrict access to this port immediately using firewalls or network access control lists. Coordinate with your infrastructure team to confirm ownership of these instances and prepare to implement official vendor updates once available.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.