CVE-2026-22306
Critical
Description
Download of code without integrity check, inclusion of functionality from untrusted control sphere, and cleartext transmission of sensitive information vulnerability in Ozols Grupa OZOLS on Windows caused by an abandoned auto-update domain. Affected component: the automatic update channel - OzolsSQL client update path, the <db>_update SQL Server Agent job (@subsystem = N'ActiveScripting') and serv_update.vbs. This issue affects OZOLS: before 1.1.1233.
SeverityCritical
CVSS10.0
Exploit probability—
ProductOZOLS
PublishedAug 19, 2026
First seenAug 19, 2026
Weakness typeCWE-494CWE-494CWE-829CWE-829CWE-319CWE-319
How to fix
Update
- Ozols Grupa OZOLS1.1.1233 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Ozols Grupa OZOLS | v < 1.1.1233 | 1.1.1233 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.