CVE-2026-22306 — Critical flaw impacting OZOLS ERP's automatic update channel
Download of code without integrity check, inclusion of functionality from untrusted control sphere, and cleartext transmission of sensitive information vulnerability in Ozols G…
Published: 2026-08-19 · CVSS: 10.0 · CVSS 4.0
Download of code without integrity check, inclusion of functionality from untrusted control sphere, and cleartext transmission of sensitive information vulnerability in Ozols Grupa OZOLS on Windows caused by an abandoned auto-update domain. Affected component: the automatic update channel - OzolsSQL client update path, the <db>_update SQL Server Agent job (@subsystem = N'ActiveScripting') and serv_update.vbs. This issue affects OZOLS: before 1.1.1233.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7