MyReport Updater (<= 2.1.1) - CraftedSignal Threat Feed

Local Privilege Escalation in MyReport Updater via DLL Hijacking

hello@craftedsignal.io — Wed, 14 Oct 2026 16:37:30 +0000

MyReport Updater through version 2.1.1 contains a local privilege escalation (LPE) vulnerability (CVE-2026-110633) stemming from insecure gRPC communication handled by the UpdaterManager.exe service. This service, which runs with SYSTEM privileges, fails to properly validate the reference server and installLocation parameters provided by users over the gRPC interface. An unprivileged attacker can exploit this flaw to instruct the service to download and extract a malicious archive into an arbitrary filesystem directory. By specifying an install location that enables DLL hijacking, the attacker can place a malicious version of HID.dll such that it is subsequently loaded by the On-Screen Keyboard process (osk.exe) when it initiates under a SYSTEM context. This allows the attacker to transition from a low-privileged user account to full system-level access.

Impact

Successful exploitation allows a local user to gain SYSTEM privileges on the affected host. This vulnerability has a CVSS v3.1 base score of 7.8, representing a significant risk in multi-user or shared workstation environments where MyReport Updater is deployed. Organizations using versions 2.1.1 and earlier are at risk of complete system compromise if an unprivileged user gains local access to the system.

Recommendation

Upgrade all instances of MyReport Updater to a version beyond 2.1.1 immediately.
Monitor for unauthorized gRPC communication directed at UpdaterManager.exe from non-privileged user accounts.
Audit filesystem permissions on critical directories to prevent local users from writing DLLs to paths where system processes load dependencies.
Use EDR/Sysmon telemetry to baseline legitimate dependency loading for system binaries like osk.exe.

Unauthenticated Remote Code Execution in MyReport Updater via gRPC

hello@craftedsignal.io — Wed, 14 Oct 2026 16:37:20 +0000

Report One MyReport Updater, in versions 2.1.1 and earlier, exposes an unauthenticated gRPC service listening on TCP port 9095. This service provides methods that can be accessed by any network-adjacent attacker without authentication. Specifically, the UpdateConfigReferent method is vulnerable to manipulation, allowing an attacker to force the updater to pull update module archives from an attacker-controlled remote server. Because the application fails to adequately validate the authenticity of the update source, the updater will accept malicious module archives as long as the attacker provides matching MD5 digests. This flaw allows for arbitrary file writes, resulting in code execution with SYSTEM privileges on the affected host. Given the elevated permissions of the updater service, this vulnerability poses a critical risk to systems running MyReport Updater.

Impact

The vulnerability allows unauthenticated remote attackers to gain full control over the affected system. Since the updater runs with SYSTEM privileges, the impact includes complete compromise of the host, potential lateral movement within the network, and the deployment of persistent malicious modules. This affects all organizations utilizing MyReport Updater versions 2.1.1 or earlier.

Recommendation

Patch immediately: Upgrade all instances of MyReport Updater to a version beyond 2.1.1 as soon as the vendor provides a security update.
Network isolation: Restrict inbound access to TCP port 9095 to authorized management subnets only; the service should not be exposed to untrusted networks.
Monitoring: Monitor for unexpected network connections originating from the host running the MyReport Updater service, especially outbound connections to unknown or non-official update servers.