CVE-2026-22306

Received Received - Intake

OZOLS Windows Update Integrity Flaw Exposes Sensitive Data

Publication date: 2026-08-19

Last updated on: 2026-08-19

Assigner: ENISA

Description

Download of code without integrity check, inclusion of functionality from untrusted control sphere, and cleartext transmission of sensitive information vulnerability in Ozols Grupa OZOLS on Windows caused by an abandoned auto-update domain. Affected component: the automatic update channel - OzolsSQL client update path, the <db>_update SQL Server Agent job (@subsystem = N'ActiveScripting') and serv_update.vbs. This issue affects OZOLS: before 1.1.1233.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-19

Last Modified

2026-08-19

Generated

2026-08-20

AI Q&A

2026-08-20

EPSS Evaluated

N/A

NVD

CVE-2026-22306

EUVD

EUVD-2026-62704

Affected Vendors & Products

Vendor	Product	Version / Range
ozols_grupa	ozolssql	to 1.1.1233 (exc)
ozols_grupa	ozols_sql	to 1.1.1233 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-319	The product transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.
CWE-829	The product imports, requires, or includes executable functionality (such as a library) from a source that is outside of the intended control sphere.
CWE-494	The product downloads source code or an executable from a remote location and executes the code without sufficiently verifying the origin and integrity of the code.

Attack-Flow Graph

Executive Summary

This vulnerability involves the OZOLS ERP system downloading and executing code from an abandoned update domain (its2.lv) that the vendor no longer controls. The issue stems from hardcoded references in the software that allow remote attackers to execute arbitrary code on affected systems.

Impact Analysis

If exploited, this vulnerability could allow attackers to remotely execute malicious code on your system, potentially leading to data breaches, unauthorized access, or complete system compromise. All versions before 1.1.1233 are affected.

Compliance Impact

This vulnerability could lead to unauthorized data access or exfiltration, violating GDPR (data protection) and HIPAA (health data security) requirements. Non-compliance risks include fines, legal penalties, and reputational damage.

Mitigation Strategies

Update OZOLS to version 1.1.1233 or later to address the abandoned auto-update domain issue. Remove or block references to the hardcoded domain its2.lv in the update paths and SQL Server Agent jobs. Disable the serv_update.vbs script if no longer needed.

Hi! I’m here to help you understand CVE-2026-22306. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70