{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/vendors/report-one/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:reportone:myreport_updater:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":8.1,"id":"CVE-2026-110632"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["MyReport Updater (\u003c= 2.1.1)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["Report One"],"content_html":"\u003cp\u003eReport One MyReport Updater, in versions 2.1.1 and earlier, exposes an unauthenticated gRPC service listening on TCP port 9095. This service provides methods that can be accessed by any network-adjacent attacker without authentication. Specifically, the UpdateConfigReferent method is vulnerable to manipulation, allowing an attacker to force the updater to pull update module archives from an attacker-controlled remote server. Because the application fails to adequately validate the authenticity of the update source, the updater will accept malicious module archives as long as the attacker provides matching MD5 digests. This flaw allows for arbitrary file writes, resulting in code execution with SYSTEM privileges on the affected host. Given the elevated permissions of the updater service, this vulnerability poses a critical risk to systems running MyReport Updater.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe vulnerability allows unauthenticated remote attackers to gain full control over the affected system. Since the updater runs with SYSTEM privileges, the impact includes complete compromise of the host, potential lateral movement within the network, and the deployment of persistent malicious modules. This affects all organizations utilizing MyReport Updater versions 2.1.1 or earlier.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003ePatch immediately: Upgrade all instances of MyReport Updater to a version beyond 2.1.1 as soon as the vendor provides a security update.\u003c/li\u003e\n\u003cli\u003eNetwork isolation: Restrict inbound access to TCP port 9095 to authorized management subnets only; the service should not be exposed to untrusted networks.\u003c/li\u003e\n\u003cli\u003eMonitoring: Monitor for unexpected network connections originating from the host running the MyReport Updater service, especially outbound connections to unknown or non-official update servers.\u003c/li\u003e\n\u003c/ol\u003e\n","date_modified":"2026-10-14T16:37:20Z","date_published":"2026-10-14T16:37:20Z","id":"https://feed.craftedsignal.io/briefs/2026-10-report-one-myreport-updater-grpc-rce/","summary":"Report One MyReport Updater versions 2.1.1 and earlier contain an unauthenticated gRPC service vulnerability allowing remote attackers to hijack the update process and achieve SYSTEM-level code execution.","title":"Unauthenticated Remote Code Execution in MyReport Updater via gRPC","url":"https://feed.craftedsignal.io/briefs/2026-10-report-one-myreport-updater-grpc-rce/"}],"language":"en","title":"CraftedSignal Threat Feed - Report One","version":"https://jsonfeed.org/version/1.1"}