CVE-2026-22306

10.0 criticalEPSS 0.2%

Critical (10.0). EPSS 0.2% chance of exploitation in the next 30 days.

Download of code without integrity check, inclusion of functionality from untrusted control sphere, and cleartext transmission of sensitive information vulnerability in Ozols Grupa OZOLS on Windows caused by an abandoned auto-update domain. Affected component: the automatic update channel - OzolsSQL client update path, the <db>_update SQL Server Agent job (@subsystem = N'ActiveScripting') and serv_update.vbs. This issue affects OZOLS: before 1.1.1233.

Severity

CVSS 4.0

10.0 critical

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

CVSS 3.1

10.0 critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

EPSS: 0.2% chance of exploitation in the next 30 days; higher than 10% of CVEs (scores of 2026-10-31)
CWEs: CWE-319, CWE-494, CWE-829
Published: 2026-08-19
Modified: 2026-09-01
Record from: the NVD, synced 2026-10-19

References

https://offseq.com/en/research/ozols-cve-2026-22306
https://offseq.com/en/research/ozols-cve-2026-22306/#s-04

Check your stack JSON