{"id":"CVE-2026-22306","aliases":["EUVD-2026-62704","GHSA-xhj7-3r6j-f89h"],"status":"published","title":"Critical flaw impacting OZOLS ERP's automatic update channel","description":"Download of code without integrity check, inclusion of functionality from untrusted control sphere, and cleartext \ntransmission of sensitive information vulnerability in Ozols Grupa OZOLS\n on Windows caused by an abandoned auto-update domain. Affected\ncomponent: the automatic update channel - OzolsSQL client update path, the \u003cdb\u003e_update SQL Server Agent job (@subsystem = N'ActiveScripting') and serv_update.vbs.\n\nThis issue affects OZOLS: before 1.1.1233.","severity":{"version":"4.0","score":10,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00207,"percentile":0.1087,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-319","CWE-494","CWE-829"],"published":"2026-08-19T19:25:10Z","modified":"2026-09-01T21:07:58Z","products":[{"vendor":"ozols grupa","product":"ozols"}],"references":[{"url":"https://offseq.com/en/research/ozols-cve-2026-22306","tags":["third-party-advisory"]},{"url":"https://offseq.com/en/research/ozols-cve-2026-22306/#s-04","tags":["exploit"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-22306"},{"url":"https://github.com/advisories/GHSA-xhj7-3r6j-f89h"}],"sources":{"cve":[{"id":"CVE-2026-22306","title":"Critical flaw impacting OZOLS ERP's automatic update channel","description":"Download of code without integrity check, inclusion of functionality from untrusted control sphere, and cleartext \ntransmission of sensitive information vulnerability in Ozols Grupa OZOLS\n on Windows caused by an abandoned auto-update domain. Affected\ncomponent: the automatic update channel - OzolsSQL client update path, the \u003cdb\u003e_update SQL Server Agent job (@subsystem = N'ActiveScripting') and serv_update.vbs.\n\nThis issue affects OZOLS: before 1.1.1233.","status":"published","published":"2026-08-19T19:25:10.53Z","modified":"2026-08-26T19:29:42.941Z","cvss":[{"version":"4.0","score":10,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","level":"critical","assessor":"cna"},{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"cna"}],"cwes":["CWE-494","CWE-829","CWE-319"],"updated_at":"2026-11-02T13:39:05.585774Z"}],"euvd":[{"id":"EUVD-2026-62704","description":"Download of code without integrity check, inclusion of functionality from untrusted control sphere, and cleartext \ntransmission of sensitive information vulnerability in Ozols Grupa OZOLS\n on Windows caused by an abandoned auto-update domain. Affected\ncomponent: the automatic update channel - OzolsSQL client update path, the \u003cdb\u003e_update SQL Server Agent job (@subsystem = N'ActiveScripting') and serv_update.vbs.\n\nThis issue affects OZOLS: before 1.1.1233.","status":"published","published":"2026-08-19T19:25:10Z","modified":"2026-08-26T19:29:42Z","cvss":[{"version":"4.0","score":10,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","level":"critical"}],"updated_at":"2026-11-02T18:01:29.296861Z"}],"ghsa":[{"id":"GHSA-xhj7-3r6j-f89h","title":"Download of code without integrity check, inclusion of functionality from untrusted control...","description":"Download of code without integrity check, inclusion of functionality from untrusted control sphere, and cleartext \ntransmission of sensitive information vulnerability in Ozols Grupa OZOLS\n on Windows caused by an abandoned auto-update domain. Affected\ncomponent: the automatic update channel - OzolsSQL client update path, the \u003cdb\u003e_update SQL Server Agent job (@subsystem = N'ActiveScripting') and serv_update.vbs.\n\nThis issue affects OZOLS: before 1.1.1233.","status":"published","published":"2026-08-19T21:30:36Z","modified":"2026-08-26T21:32:33Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical"},{"version":"4.0","score":10,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"critical"}],"cwes":["CWE-319"],"updated_at":"2026-11-02T15:11:01.362113Z"}],"nvd":[{"id":"CVE-2026-22306","description":"Download of code without integrity check, inclusion of functionality from untrusted control sphere, and cleartext \ntransmission of sensitive information vulnerability in Ozols Grupa OZOLS\n on Windows caused by an abandoned auto-update domain. Affected\ncomponent: the automatic update channel - OzolsSQL client update path, the \u003cdb\u003e_update SQL Server Agent job (@subsystem = N'ActiveScripting') and serv_update.vbs.\n\nThis issue affects OZOLS: before 1.1.1233.","status":"published","published":"2026-08-19T20:17:16.007Z","modified":"2026-09-01T21:07:58.98Z","cvss":[{"version":"4.0","score":10,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"critical","assessor":"secondary"},{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-319","CWE-494","CWE-829"],"updated_at":"2026-11-02T14:12:39.962615Z"}]}}