Vulnerability · Published Aug 19, 2026 · Assigned by ENISA

CVE-2026-22306Critical flaw impacting OZOLS ERP's automatic update channel

Critical 10.0

In plain English

A critical-severity security flaw in OZOLS from Ozols Grupa. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 11% of all known vulnerabilities).

Severity (CVSS 3.1)10.0Critical

Exploit odds (30 days)0.2%top 89.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Download of code without integrity check, inclusion of functionality from untrusted control sphere, and cleartext transmission of sensitive information vulnerability in Ozols Grupa OZOLS on Windows caused by an abandoned auto-update domain. Affected component: the automatic update channel - OzolsSQL client update path, the <db>_update SQL Server Agent job (@subsystem = N'ActiveScripting') and serv_update.vbs. This issue affects OZOLS: before 1.1.1233.

Affected products (as reported)

Vendor	Product	Versions
Ozols Grupa	OZOLS	0 – before 1.1.1233

Weakness: CWE-494, CWE-829, CWE-319 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

References

https://offseq.com/en/research/ozols-cve-2026-22306 third-party-advisory
https://offseq.com/en/research/ozols-cve-2026-22306/#s-04 exploit