MyReport Updater EUVD-2026-101260

Exploitation requires network reachability to the MyReport Updater's gRPC service on TCP port 9095, which is exposed without authentication (PR:N) - any attacker able to route to that port can call UpdateConfigReferent, so segmenting or firewalling port 9095 is the primary mitigation. The key limiting factor is that the attacker must stand up a malicious reference server delivering module archives whose MD5 digests match what the updater expects, reflected as AC:H/AT:P in the CVSS 4.0 vector; this is feasible given MD5 collision weaknesses but is more than a single-packet trigger. No user interaction and no valid credentials are needed, and no non-default configuration is described - the unauthenticated service appears to be the default posture through version 2.1.1.

This is a genuine high-priority issue, not a CVSS-inflated paper risk. The signals are mutually reinforcing: CWE-306 (missing authentication) matches the described unauthenticated gRPC service, the CVSS 4.0 vector confirms network reach with no privileges or user interaction (AV:N/PR:N/UI:N), and the technical impact is full compromise - code execution as SYSTEM with high confidentiality, integrity, and availability impact (VC:H/VI:H/VA:H). Publicly available exploit code exists (Quarkslab blog plus VulnCheck advisory), which raises the practical exploitation likelihood. The one tempering factor is attack complexity: the CVSS 4.0 vector sets AC:H and AT:P (attack requirements present) because successful exploitation depends on the attacker staging a malicious reference server whose module archives carry matching MD5 digests - a non-trivial but achievable prerequisite given MD5's known collision weakness. No CISA KEV listing and no EPSS score were provided in the input, so there is no evidence of confirmed in-the-wild exploitation yet; the risk here is driven by the public POC and the SYSTEM-level impact rather than observed mass exploitation. Net: treat as urgent for any exposed MyReport Updater instance, while noting exploitation is not fully trivial (AC:H/AT:P) and active exploitation is unconfirmed.

A remote attacker who can reach TCP port 9095 invokes the unauthenticated gRPC UpdateConfigReferent method to repoint the SYSTEM-level updater at an attacker-controlled reference server. The attacker serves modified module archives crafted to present matching MD5 digests, which the updater fetches and installs, writing files and executing arbitrary code as SYSTEM. A public proof-of-concept and technical write-up from Quarkslab/VulnCheck exist, lowering the barrier to weaponization.