Read the docs
TI-2026-74127 Aliases CVE-2026-110633GHSA-www7-gw3x-qcrq

Local privilege escalation in MyReport Updater service

Priority LOW 36CWE-269Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Privilege escalation
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-269.

Summary

MyReport Updater through 2.1.1 contains a local privilege escalation flaw (CWE-269) in which the SYSTEM updater service installs attacker-supplied archives into arbitrary directories. A local user with low privileges can point the updater to a malicious reference server and install location, planting a DLL that gives the attacker SYSTEM privileges. An exploit link is listed in the references.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

MyReport Updater through 2.1.1 contains a local privilege escalation vulnerability that allows low-privileged users to make the SYSTEM updater service install attacker-supplied archives into arbitrary directories. Attackers can use UpdaterManager.exe over gRPC to set a malicious reference server and installLocation, planting a DLL like HID.dll loaded by osk.exe to gain SYSTEM privileges.

Why it matters now

EPSS 0.00137 3rd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
Report OneMyReport Updaterup to 2.1.1—No fix listedCNA
  • MyReport Updater VendorReport One Affected up to 2.1.1 Fixed in — No fix listed CNA

Remediation

The sources list no fixed version for MyReport Updater.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Timeline

  1. 2026-10-14 Threatist record created from CVE-2026-110633
  2. 2026-10-14 Alias added: GHSA-www7-gw3x-qcrq
  3. 2026-10-16 Priority changed: MEDIUM → LOW

References

Exploit 1

Other 1

  • TI-2026-74126 Report One MyReport Updater Unauthenticated gRPC Service Remote Code Execution CVSS 4.0CRITICAL 9.2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences