by Kastro
Paper/Archive/CVE-2026-22306

CVE-2026-22306

Ozols Grupa OZOLS — Critical flaw impacting OZOLS ERP's automatic update channel

EPSS 0.2%public exploitCVSS 10.0
critical.is priorityof 100
42
CVSS 10.0 (CNA)10.0 / 10 × 3030.0Not in CISA KEV+300.0EPSS percentile 10.8.108 × 202.2Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

Download of code without integrity check, inclusion of functionality from untrusted control sphere, and cleartext transmission of sensitive information vulnerability in Ozols Grupa OZOLS on Windows caused by an abandoned auto-update domain. Affected component: the automatic update channel - OzolsSQL client update path, the <db>_update SQL Server Agent job (@subsystem = N'ActiveScripting') and serv_update.vbs. This issue affects OZOLS: before 1.1.1233.

Affected

ProductAffectedFixed inSource
OZOLS< 1.1.12331.1.1233CNA

Scores by source

ENISA (CNA)10.0CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
ENISA (CNA)10.0CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: total

References

writeupoffseq.com/en/research/ozols-cve-2026-22306exploitoffseq.com/en/research/ozols-cve-2026-22306/#s-04