CVE-2026-22306: Critical flaw impacting OZOLS ERP's automatic update channel

Severity: critical (CVSS 10.0 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-08-19 · updated 2026-09-01
Weakness: CWE-319

Description

Download of code without integrity check, inclusion of functionality from untrusted control sphere, and cleartext transmission of sensitive information vulnerability in Ozols Grupa OZOLS on Windows caused by an abandoned auto-update domain. Affected component: the automatic update channel - OzolsSQL client update path, the <db>_update SQL Server Agent job (@subsystem = N'ActiveScripting') and serv_update.vbs. This issue affects OZOLS: before 1.1.1233.

Affected products

Ozols Grupa OZOLS: before 1.1.1233 — fixed in 1.1.1233

How to fix

Upgrade to a fixed version: Ozols Grupa OZOLS 1.1.1233. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-22306 or the next vulnerability affects your stack