CVE-2026-22306CWE-319CWE-494CWE-829

CVE-2026-22306

Critical · published August 20, 2026

CVSS v3.1
10.0
EPSS
0%
Percentile
10.3
In the wild
Unconfirmed
What it is

Download of code without integrity check, inclusion of functionality from untrusted control sphere, and cleartext

transmission of sensitive information vulnerability in Ozols Grupa OZOLS

on Windows caused by an abandoned auto-update domain. Affected

component: the automatic update channel - OzolsSQL client update path, the <db>_update SQL Server Agent job (@subsystem = N'ActiveScripting') and serv_update.vbs.

This issue affects OZOLS: before 1.1.1233.

The record
Technical detail
CVSS v3.1
10.0 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CVSS v4.0
10.0 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
EPSS
0.00207 · 10.3th percentile
Weaknesses
CWE-319 · Cleartext Transmission of Sensitive Information; CWE-494 · Download of Code Without Integrity Check; CWE-829 · Inclusion of Functionality from Untrusted Control Sphere
Published
2026-08-20T00:17Z
References (2)
https://offseq.com/en/research/ozols-cve-2026-22306/#s-04 · 134c704f-9b21-4f2e-91b3-4a467353bcc0https://offseq.com/en/research/ozols-cve-2026-22306 · a6d3dc9e-0591-4a13-bce7-0f5b31ff6158
EPSS history
Timeline
  • 19 AUG 19:25Z
    Critical flaw impacting OZOLS ERP's automatic update channel
    cvelistv5