CVE-2026-22306
Critical flaw impacting OZOLS ERP's automatic update channel
- Published
- Updated
- Reserved
- Assigned by
- ENISA
Description
Download of code without integrity check, inclusion of functionality from untrusted control sphere, and cleartext transmission of sensitive information vulnerability in Ozols Grupa OZOLS on Windows caused by an abandoned auto-update domain. Affected component: the automatic update channel - OzolsSQL client update path, the <db>_update SQL Server Agent job (@subsystem = N'ActiveScripting') and serv_update.vbs. This issue affects OZOLS: before 1.1.1233.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| ENISACNA (assigner) | 4.0 | Critical10.0 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H |
| ENISACNA (assigner) | 3.1 | Critical10.0 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H |
| NVDNVD · Deferred | 4.0 | Critical10.0 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
- EPSS (exploitation in 30 days)
- 0.21% · top 89% of all CVEs (6 Nov 2026)
- CISA SSVC
- Exploitation: poc · Automatable: yes · Technical impact: total
The list uses the assigner's score when there is one, then CISA's, then NVD's: Critical 10.0.
Weakness
- CWE-494 Download of code without integrity check (opens in a new tab)All about CWE-494 and its CVEs
- CWE-829 Inclusion of functionality from untrusted control sphere (opens in a new tab)All about CWE-829 and its CVEs
- CWE-319 Cleartext transmission of sensitive information (opens in a new tab)All about CWE-319 and its CVEs
Affected products
- affected < 1.1.1233
What to do
Workaround: * disable or delete the <db>_update SQL Server Agent job and remove serv_update.vbs; * block outbound access from database servers and workstations to its2.lv / www2.its2.lv, and restrict arbitrary outbound HTTP from those hosts; * disable xp_cmdshell on affected SQL Server instances; * run the SQL Server service under a least-privilege account; * inspect the sprg table for unexpected version increments or archive contents.
References (2)
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://trackcve.app/cve/CVE-2026-22306)Record last updated .