CVE-2026-22306 (GCVE-0-2026-22306)
Vulnerability from cvelistv5
Published
2026-08-19 19:25
Modified
2026-08-26 19:29
Severity ?
10.0 (Critical) - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
10.0 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CWE
  • CWE-494 - Download of code without integrity check
  • CWE-829 - Inclusion of functionality from untrusted control sphere
  • CWE-319 - Cleartext transmission of sensitive information
Summary
Download of code without integrity check, inclusion of functionality from untrusted control sphere, and cleartext transmission of sensitive information vulnerability in Ozols Grupa OZOLS on Windows caused by an abandoned auto-update domain. Affected component: the automatic update channel - OzolsSQL client update path, the <db>_update SQL Server Agent job (@subsystem = N'ActiveScripting') and serv_update.vbs. This issue affects OZOLS: before 1.1.1233.
References
Impacted products
Vendor Product Version
Ozols Grupa OZOLS Version: 0   ≤
Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-22306",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-26T19:29:24.039857Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-26T19:29:42.941Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://offseq.com/en/research/ozols-cve-2026-22306/#s-04"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "Windows"
          ],
          "product": "OZOLS",
          "vendor": "Ozols Grupa",
          "versions": [
            {
              "lessThan": "1.1.1233",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Nils Putni\u0146\u0161, OffSeq (SIA SEQ)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "CERT.LV"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Download of code without integrity check, inclusion of functionality from untrusted control sphere, and cleartext \ntransmission of sensitive information vulnerability in Ozols Grupa OZOLS\n on Windows caused by an\u0026nbsp;\u003cspan\u003eabandoned auto-update domain\u003c/span\u003e.\u0026nbsp;\u003cspan\u003eAffected\ncomponent: the automatic update channel -\u0026nbsp;\u003c/span\u003e\u003cspan\u003eOzolsSQL\u003c/span\u003e\u003cspan\u003e\u0026nbsp;client update path, the\u0026nbsp;\u003c/span\u003e\u003cspan\u003e\u0026lt;db\u0026gt;_update\u003c/span\u003e\u003cspan\u003e\u0026nbsp;SQL Server Agent job (\u003c/span\u003e\u003cspan\u003e@subsystem = N\u0027ActiveScripting\u0027\u003c/span\u003e\u003cspan\u003e) and\u0026nbsp;\u003c/span\u003e\u003cspan\u003eserv_update.vbs\u003c/span\u003e\u003cspan\u003e.\u003c/span\u003e\u003cbr\u003e\u003cbr\u003eThis issue affects OZOLS: before 1.1.1233."
            }
          ],
          "value": "Download of code without integrity check, inclusion of functionality from untrusted control sphere, and cleartext \ntransmission of sensitive information vulnerability in Ozols Grupa OZOLS\n on Windows caused by an\u00a0abandoned auto-update domain.\u00a0Affected\ncomponent: the automatic update channel -\u00a0OzolsSQL\u00a0client update path, the\u00a0\u003cdb\u003e_update\u00a0SQL Server Agent job (@subsystem = N\u0027ActiveScripting\u0027) and\u00a0serv_update.vbs.\n\nThis issue affects OZOLS: before 1.1.1233."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-186",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-186 Malicious Software Update"
            }
          ]
        },
        {
          "capecId": "CAPEC-187",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-187 Malicious Automated Software Update via Redirection"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 10,
            "baseSeverity": "CRITICAL",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "HIGH",
            "subConfidentialityImpact": "HIGH",
            "subIntegrityImpact": "HIGH",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 10,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-494",
              "description": "CWE-494 Download of code without integrity check",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-829",
              "description": "CWE-829 Inclusion of functionality from untrusted control sphere",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-319",
              "description": "CWE-319 Cleartext transmission of sensitive information",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-19T19:25:10.530Z",
        "orgId": "a6d3dc9e-0591-4a13-bce7-0f5b31ff6158",
        "shortName": "ENISA"
      },
      "references": [
        {
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://offseq.com/en/research/ozols-cve-2026-22306"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Critical flaw impacting OZOLS ERP\u0027s automatic update channel",
      "workarounds": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cul\u003e\u003cli\u003e\u003cspan\u003edisable\n     or delete the\u0026nbsp;\u003c/span\u003e\u003cspan\u003e\u0026lt;db\u0026gt;_update\u003c/span\u003e\u003cspan\u003e\u0026nbsp;SQL\n     Server Agent job and remove\u0026nbsp;\u003c/span\u003e\u003cspan\u003eserv_update.vbs\u003c/span\u003e\u003cspan\u003e;\u003c/span\u003e\u003c/li\u003e\u003cli\u003e\u003cspan\u003eblock\n     outbound access from database servers and workstations to\u0026nbsp;\u003c/span\u003e\u003cspan\u003eits2.lv\u003c/span\u003e\u003cspan\u003e\u0026nbsp;/\u0026nbsp;\u003c/span\u003e\u003cspan\u003ewww2.its2.lv\u003c/span\u003e\u003cspan\u003e, and\n     restrict arbitrary outbound HTTP from those hosts;\u003c/span\u003e\u003c/li\u003e\u003cli\u003e\u003cspan\u003edisable\u0026nbsp;\u003c/span\u003e\u003cspan\u003exp_cmdshell\u003c/span\u003e\u003cspan\u003e\u0026nbsp;on\n     affected SQL Server instances;\u003c/span\u003e\u003c/li\u003e\u003cli\u003e\u003cspan\u003erun the\n     SQL Server service under a least-privilege account;\u003c/span\u003e\u003c/li\u003e\u003cli\u003e\u003cspan\u003einspect\n     the\u0026nbsp;\u003c/span\u003e\u003cspan\u003esprg\u003c/span\u003e\u003cspan\u003e\u0026nbsp;table\n     for unexpected version increments or archive contents.\u003c/span\u003e\u003c/li\u003e\u003c/ul\u003e"
            }
          ],
          "value": "*  disable\n     or delete the\u00a0\u003cdb\u003e_update\u00a0SQL\n     Server Agent job and remove\u00a0serv_update.vbs;\n  *  block\n     outbound access from database servers and workstations to\u00a0its2.lv\u00a0/\u00a0www2.its2.lv, and\n     restrict arbitrary outbound HTTP from those hosts;\n  *  disable\u00a0xp_cmdshell\u00a0on\n     affected SQL Server instances;\n  *  run the\n     SQL Server service under a least-privilege account;\n  *  inspect\n     the\u00a0sprg\u00a0table\n     for unexpected version increments or archive contents."
        }
      ],
      "x_generator": {
        "engine": "Vulnogram 1.0.4"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a6d3dc9e-0591-4a13-bce7-0f5b31ff6158",
    "assignerShortName": "ENISA",
    "cveId": "CVE-2026-22306",
    "datePublished": "2026-08-19T19:25:10.530Z",
    "dateReserved": "2026-01-07T09:31:00.562Z",
    "dateUpdated": "2026-08-26T19:29:42.941Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-22306\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"poc\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-08-26T19:29:24.039857Z\"}}}], \"references\": [{\"url\": \"https://offseq.com/en/research/ozols-cve-2026-22306/#s-04\", \"tags\": [\"exploit\"]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-08-26T19:29:35.763Z\"}}], \"cna\": {\"title\": \"Critical flaw impacting OZOLS ERP\u0027s automatic update channel\", \"source\": {\"discovery\": \"UNKNOWN\"}, \"credits\": [{\"lang\": \"en\", \"type\": \"finder\", \"value\": \"Nils Putni\\u0146\\u0161, OffSeq (SIA SEQ)\"}, {\"lang\": \"en\", \"type\": \"coordinator\", \"value\": \"CERT.LV\"}], \"impacts\": [{\"capecId\": \"CAPEC-186\", \"descriptions\": [{\"lang\": \"en\", \"value\": \"CAPEC-186 Malicious Software Update\"}]}, {\"capecId\": \"CAPEC-187\", \"descriptions\": [{\"lang\": \"en\", \"value\": \"CAPEC-187 Malicious Automated Software Update via Redirection\"}]}], \"metrics\": [{\"format\": \"CVSS\", \"cvssV4_0\": {\"Safety\": \"NOT_DEFINED\", \"version\": \"4.0\", \"Recovery\": \"NOT_DEFINED\", \"baseScore\": 10, \"Automatable\": \"NOT_DEFINED\", \"attackVector\": \"NETWORK\", \"baseSeverity\": \"CRITICAL\", \"valueDensity\": \"NOT_DEFINED\", \"vectorString\": \"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H\", \"exploitMaturity\": \"NOT_DEFINED\", \"providerUrgency\": \"NOT_DEFINED\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"attackRequirements\": \"NONE\", \"privilegesRequired\": \"NONE\", \"subIntegrityImpact\": \"HIGH\", \"vulnIntegrityImpact\": \"HIGH\", \"subAvailabilityImpact\": \"HIGH\", \"vulnAvailabilityImpact\": \"HIGH\", \"subConfidentialityImpact\": \"HIGH\", \"vulnConfidentialityImpact\": \"HIGH\", \"vulnerabilityResponseEffort\": \"NOT_DEFINED\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}, {\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"CHANGED\", \"version\": \"3.1\", \"baseScore\": 10, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"CRITICAL\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"HIGH\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"vendor\": \"Ozols Grupa\", \"product\": \"OZOLS\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"1.1.1233\", \"versionType\": \"semver\"}], \"platforms\": [\"Windows\"], \"defaultStatus\": \"unaffected\"}], \"references\": [{\"url\": \"https://offseq.com/en/research/ozols-cve-2026-22306\", \"tags\": [\"third-party-advisory\"]}], \"workarounds\": [{\"lang\": \"en\", \"value\": \"*  disable\\n     or delete the\\u00a0\u003cdb\u003e_update\\u00a0SQL\\n     Server Agent job and remove\\u00a0serv_update.vbs;\\n  *  block\\n     outbound access from database servers and workstations to\\u00a0its2.lv\\u00a0/\\u00a0www2.its2.lv, and\\n     restrict arbitrary outbound HTTP from those hosts;\\n  *  disable\\u00a0xp_cmdshell\\u00a0on\\n     affected SQL Server instances;\\n  *  run the\\n     SQL Server service under a least-privilege account;\\n  *  inspect\\n     the\\u00a0sprg\\u00a0table\\n     for unexpected version increments or archive contents.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cul\u003e\u003cli\u003e\u003cspan\u003edisable\\n     or delete the\u0026nbsp;\u003c/span\u003e\u003cspan\u003e\u0026lt;db\u0026gt;_update\u003c/span\u003e\u003cspan\u003e\u0026nbsp;SQL\\n     Server Agent job and remove\u0026nbsp;\u003c/span\u003e\u003cspan\u003eserv_update.vbs\u003c/span\u003e\u003cspan\u003e;\u003c/span\u003e\u003c/li\u003e\u003cli\u003e\u003cspan\u003eblock\\n     outbound access from database servers and workstations to\u0026nbsp;\u003c/span\u003e\u003cspan\u003eits2.lv\u003c/span\u003e\u003cspan\u003e\u0026nbsp;/\u0026nbsp;\u003c/span\u003e\u003cspan\u003ewww2.its2.lv\u003c/span\u003e\u003cspan\u003e, and\\n     restrict arbitrary outbound HTTP from those hosts;\u003c/span\u003e\u003c/li\u003e\u003cli\u003e\u003cspan\u003edisable\u0026nbsp;\u003c/span\u003e\u003cspan\u003exp_cmdshell\u003c/span\u003e\u003cspan\u003e\u0026nbsp;on\\n     affected SQL Server instances;\u003c/span\u003e\u003c/li\u003e\u003cli\u003e\u003cspan\u003erun the\\n     SQL Server service under a least-privilege account;\u003c/span\u003e\u003c/li\u003e\u003cli\u003e\u003cspan\u003einspect\\n     the\u0026nbsp;\u003c/span\u003e\u003cspan\u003esprg\u003c/span\u003e\u003cspan\u003e\u0026nbsp;table\\n     for unexpected version increments or archive contents.\u003c/span\u003e\u003c/li\u003e\u003c/ul\u003e\", \"base64\": false}]}], \"x_generator\": {\"engine\": \"Vulnogram 1.0.4\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"Download of code without integrity check, inclusion of functionality from untrusted control sphere, and cleartext \\ntransmission of sensitive information vulnerability in Ozols Grupa OZOLS\\n on Windows caused by an\\u00a0abandoned auto-update domain.\\u00a0Affected\\ncomponent: the automatic update channel -\\u00a0OzolsSQL\\u00a0client update path, the\\u00a0\u003cdb\u003e_update\\u00a0SQL Server Agent job (@subsystem = N\u0027ActiveScripting\u0027) and\\u00a0serv_update.vbs.\\n\\nThis issue affects OZOLS: before 1.1.1233.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"Download of code without integrity check, inclusion of functionality from untrusted control sphere, and cleartext \\ntransmission of sensitive information vulnerability in Ozols Grupa OZOLS\\n on Windows caused by an\u0026nbsp;\u003cspan\u003eabandoned auto-update domain\u003c/span\u003e.\u0026nbsp;\u003cspan\u003eAffected\\ncomponent: the automatic update channel -\u0026nbsp;\u003c/span\u003e\u003cspan\u003eOzolsSQL\u003c/span\u003e\u003cspan\u003e\u0026nbsp;client update path, the\u0026nbsp;\u003c/span\u003e\u003cspan\u003e\u0026lt;db\u0026gt;_update\u003c/span\u003e\u003cspan\u003e\u0026nbsp;SQL Server Agent job (\u003c/span\u003e\u003cspan\u003e@subsystem = N\u0027ActiveScripting\u0027\u003c/span\u003e\u003cspan\u003e) and\u0026nbsp;\u003c/span\u003e\u003cspan\u003eserv_update.vbs\u003c/span\u003e\u003cspan\u003e.\u003c/span\u003e\u003cbr\u003e\u003cbr\u003eThis issue affects OZOLS: before 1.1.1233.\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-494\", \"description\": \"CWE-494 Download of code without integrity check\"}]}, {\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-829\", \"description\": \"CWE-829 Inclusion of functionality from untrusted control sphere\"}]}, {\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-319\", \"description\": \"CWE-319 Cleartext transmission of sensitive information\"}]}], \"providerMetadata\": {\"orgId\": \"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158\", \"shortName\": \"ENISA\", \"dateUpdated\": \"2026-08-19T19:25:10.530Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-22306\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-26T19:29:42.941Z\", \"dateReserved\": \"2026-01-07T09:31:00.562Z\", \"assignerOrgId\": \"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158\", \"datePublished\": \"2026-08-19T19:25:10.530Z\", \"assignerShortName\": \"ENISA\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.