Unauthenticated gRPC Flaw in MyReport Updater Enables SYSTEM Code Execution

Remote attackers can achieve full system compromise by exploiting a flaw in Report One MyReport Updater. By invoking a specific method on an exposed service, adversaries redirect the updater to malicious servers. This allows them to write arbitrary files and execute code with SYSTEM-level privileges, effectively taking complete control of the host machine.

How it unfolded

• The vulnerability exists in Report One MyReport Updater through version 2.1.1, exposing an unauthenticated gRPC service on TCP port 9095.
• Attackers invoke the UpdateConfigReferent method to redirect the SYSTEM updater to a malicious reference server.
• The attacker serves modified module archives with matching MD5 digests, allowing the updater to write files and execute code as SYSTEM.

Who is affected

Organizations using Report One MyReport Updater versions up to and including 2.1.1 are vulnerable to this attack. The flaw allows unauthenticated remote attackers to exploit the exposed gRPC service on TCP port 9095. Because the service requires no credentials, any entity with network access to the port can trigger the compromise. This mirrors the unauthenticated exposure seen in the Juniper SVR flaw RedTeam Tribune reported on 2026-10-14.

The fix

No patch or update has been confirmed by the vendor to address CVE-2026-110632. Users should assume that versions through 2.1.1 remain vulnerable until an official fix is released. Organizations should monitor vendor communications for availability of a secure version. In the interim, network segmentation may help limit exposure to the unauthenticated service.

What made it possible

Unauthenticated remote services often serve as high-value targets for initial access. When a service allows configuration changes without identity verification, attackers can manipulate system behavior. This weakness typically enables remote code execution by redirecting trusted processes to malicious resources. Teams usually monitor for unexpected outbound connections from update agents. Check whether network policies restrict access to management ports. Ensure that integrity checks for downloaded modules are robust and not easily bypassed.

Background: Network segmentation

Avoid these common segmentation errors: using flat VLANs, ignoring east-west traffic, relying on static rules, and neglecting micro-segmentation. Each mistake creates lateral movement paths for attackers. Fix them by enforcing zero trust principles, auditing flows regularly, and isolating critical assets dynamically.

Read the full guide: Network Segmentation Mistakes That Leave Your Data Exposed

What to do and how to stay safe: Report One

• Block inbound traffic to TCP port 9095 at the perimeter firewall to prevent unauthenticated access to the gRPC service.
• Monitor system logs for unexpected invocations of the UpdateConfigReferent method or connections to unknown update servers.
• Verify that all MyReport Updater instances are isolated from untrusted networks using strict network segmentation rules.
• Once the vendor provides an update, deploy the patch immediately to remediate the unauthenticated code execution flaw.

Step-by-step guide: What Is Virtual Patching: How It Works Without Code Changes

General security guidance from the RedTeam Tribune newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the CVSS score for CVE-2026-110632?

The NVD records a CVSS score of 9.2, rating the severity as CRITICAL.

Which versions of MyReport Updater are affected?

Versions through 2.1.1 are affected by this vulnerability.

Does the attack require authentication?

No, the gRPC service on TCP port 9095 is unauthenticated, allowing remote attackers to exploit it without credentials.