CVE-2026-110633 is a High severity (CVSS 7.8) local privilege escalation in MyReport Updater through 2.1.1 on Windows. A low-privileged user can make the SYSTEM updater service install files in a directory of their choice. We could not confirm a fixed version, so restrict the service.
What's affected
The record says MyReport Updater through 2.1.1 is affected. The pages we read are the VulnCheck advisory and a Quarkslab write-up of the research, which reviewed version 2.1.1. Neither names a fixed release, so we do not state one. Check with the vendor, MyReport, for an updated build.
The weakness is CWE-269, improper privilege management. According to the Quarkslab article, a user level manager program talks over gRPC to a service that runs as LocalSystem, listening on TCP port 9095 in the version it tested. The manager can choose which reference server the service downloads modules from, and which directory it installs into. The service accepted both from an unprivileged caller.
The record describes the result as the SYSTEM service installing attacker supplied archives into arbitrary directories, which leads to code running as SYSTEM. Severity differs by source. The record gives 7.8 (High). VulnCheck lists 8.5 on a CVSS 4.0 vector. Both are High.
How to check if you're exposed
Find out whether the updater is installed on your Windows machines. Look for the service and the program in the standard programs list, or query the service list.
Get-Service | Where-Object { $_.DisplayName -like "*MyReport*" }
Then check the installed version against 2.1.1. On servers shared by several users, such as terminal servers, the risk is highest, because a low-privileged user already has a session on the machine. Check whether anything listens on the port the service uses.
Get-NetTCPConnection -State Listen | Where-Object { $_.LocalPort -eq 9095 }
What to do now
- Ask MyReport for a fixed version of the updater, and install it when confirmed.
- If you do not need automatic module updates, stop and disable the updater service on shared machines.
- Use host firewall rules and application control to limit which users and programs can reach the service's local port.
- Restrict interactive logins on servers where the updater runs.
- Look for unexpected files or DLLs in application directories that the service wrote.
Why it matters
Services that run as SYSTEM and accept requests from ordinary users are a reliable source of local privilege escalation. When such a service lets the caller choose a download source and an install path, it effectively gives away the right to write files anywhere as SYSTEM.
The usual remedies are to hard code or sign the update source, check the signature of every payload, and ignore the path in the request. The record's vector is local, so this does not give remote access by itself. It does turn a foothold on a machine into full control of it. The record does not mark this CVE as known exploited, and none of the pages we read say it is.
Quick check
Does this give remote access?
No. The record lists a local attack vector. It lets someone who already has a low privilege session on the machine gain SYSTEM.
Is there a fixed version?
We could not confirm one. Contact the vendor and check for newer builds.
Sources
Last reviewed: 18 October 2026.
