CVE-2026-22306 Critical flaw impacting OZOLS ERP's automatic update channel
Attackers can execute arbitrary code and steal data via the ERP's unsecured auto-update channel due to an abandoned domain and lack of integrity checks.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-22306?
CVE-2026-22306 is a critical vulnerability in OZOLS, published on 19 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Download of code without integrity check, inclusion of functionality from untrusted control sphere, and cleartext transmission of sensitive information vulnerability in Ozols Grupa OZOLS on Windows caused by an abandoned auto-update domain. Affected component: the automatic update channel - OzolsSQL client update path, the <db>_update SQL Server Agent job (@subsystem = N'ActiveScripting') and serv_update.vbs.
This issue affects OZOLS: before 1.1.1233.
Which versions are affected by CVE-2026-22306?
How do I fix CVE-2026-22306?
No fix has been published for CVE-2026-22306 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-22306 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-22306 exists.
Sources
Also known as GHSA-xhj7-3r6j-f89h.