CVE-2026-22306

Critical flaw impacting OZOLS ERP's automatic update channel

State: Published
Severity: 10.0 Critical
Published: Aug 19, 2026
Updated: Aug 26, 2026
Reserved: Jan 7, 2026

Description

Download of code without integrity check, inclusion of functionality from untrusted control sphere, and cleartext transmission of sensitive information vulnerability in Ozols Grupa OZOLS on Windows caused by an abandoned auto-update domain. Affected component: the automatic update channel - OzolsSQL client update path, the <db>_update SQL Server Agent job (@subsystem = N'ActiveScripting') and serv_update.vbs.

This issue affects OZOLS: before 1.1.1233.

Scores

CVSS	Score	Vector	Source
4.0	10.0 Critical	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H	ENISA
3.1	10.0 Critical	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H	ENISA

Weaknesses

CWE-494 Download of code without integrity check
CWE-829 Inclusion of functionality from untrusted control sphere
CWE-319 Cleartext transmission of sensitive information

Affected Products

Product	Versions
OZOLSOzols Grupa	before 1.1.1233Affected

References

https://offseq.com/en/research/ozols-cve-2026-22306third-party-advisory
https://offseq.com/en/research/ozols-cve-2026-22306/#s-04exploit

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.