Ozols Grupa · Ozols · CVE-2026-22306
**Name of the Vulnerable Software and Affected Versions**
Ozols Grupa OZOLS versions prior to 1.1.1233
**Description**
The software contains a flaw in its automatic update channel, specifically affecting the OzolsSQL client update path, the `serv update.vbs` file, and the `<db> update` SQL Server Agent job using the `ActiveScripting` subsystem. The issue allows the download of code without integrity checks from an untrusted control sphere and the transmission of sensitive information in cleartext due to an abandoned auto-update domain. This can lead to remote code execution (RCE) via the injection of untrusted updates on Windows systems.
**Recommendations**
Update Ozols Grupa OZOLS to version 1.1.1233 or later.
As a temporary mitigation, isolate the system running the software to prevent unauthorized network access.