CVE-2026-22306

critical · 10

Download of code without integrity check, inclusion of functionality from untrusted control sphere, and cleartext transmission of sensitive information vulnerability in Ozols Grupa OZOLS on Windows caused by an abandoned auto-update domain. Affected component: the automatic update channel - OzolsSQL client update path, the <db>_update SQL Server Agent job (@subsystem = N'ActiveScripting') and serv_update.vbs. This issue affects OZOLS: before 1.1.1233.

CVSS

0.2%

EPSS (exploit prob.)

11th

EPSS percentile

2026-08-19

Published

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weaknesses

CWE-319CWE-494CWE-829

References

https://offseq.com/en/research/ozols-cve-2026-22306
https://offseq.com/en/research/ozols-cve-2026-22306/#s-04

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2026-22306