# CVE-2026-22306

## Summary

- **CVE ID:** CVE-2026-22306
- **Severity:** CRITICAL
- **CVSS Score:** 10 (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H)
- **CWE:** CWE-494, CWE-829, CWE-319
- **Published:** Aug 19, 2026
- **Last Modified:** Aug 26, 2026

## Description

Download of code without integrity check, inclusion of functionality from untrusted control sphere, and cleartext 
transmission of sensitive information vulnerability in Ozols Grupa OZOLS
 on Windows caused by an abandoned auto-update domain. Affected
component: the automatic update channel - OzolsSQL client update path, the <db>_update SQL Server Agent job (@subsystem = N'ActiveScripting') and serv_update.vbs.

This issue affects OZOLS: before 1.1.1233.

## Affected Products

- Ozols Grupa — OZOLS (0)

## References

- [CNA](https://offseq.com/en/research/ozols-cve-2026-22306)
- [CISA-ADP](https://offseq.com/en/research/ozols-cve-2026-22306/#s-04)

## Exploitation Prediction (EPSS)

- **EPSS Score:** 0.16%
- **EPSS Percentile:** 5.8

---
_Exported from OnDuty AI Vulnerability Intelligence on 2026-09-10._