CVE-2026-22306
CriticalCVSS 10.0Summary
OZOLS on Windows before version 1.1.1233 contains a vulnerability related to downloading code without integrity checks, including functionality from an untrusted control sphere, and cleartext transmission of sensitive information, caused by an abandoned auto-update domain.
Risk Assessment
An attacker could exploit the abandoned domain to inject malicious code during updates, potentially leading to full system compromise and data leakage.
Recommendation
Immediately upgrade OZOLS to version 1.1.1233 or later and verify the integrity of downloaded updates.
Original NVD description (English source)
Download of code without integrity check, inclusion of functionality from untrusted control sphere, and cleartext transmission of sensitive information vulnerability in Ozols Grupa OZOLS on Windows caused by an abandoned auto-update domain. Affected component: the automatic update channel - OzolsSQL client update path, the <db>_update SQL Server Agent job (@subsystem = N'ActiveScripting') and serv_update.vbs. This issue affects OZOLS: before 1.1.1233.