CVE-2026-22306: CWE-494 Download of code without integrity check in Ozols Grupa OZOLS

This vulnerability in OZOLS (before 1.1.1233) is caused by an abandoned auto-update domain that leads to the download of code without integrity verification, inclusion of untrusted code, and cleartext transmission of sensitive data. The affected components include the automatic update channel, the OzolsSQL client update path, the <db>_update SQL Server Agent job (using ActiveScripting), and serv_update.vbs. The CVSS 4.0 score is 10.0 (critical), indicating network attack vector, no required privileges or user interaction, and high impact on confidentiality, integrity, and availability.

An attacker can exploit this vulnerability remotely without any privileges or user interaction to execute arbitrary code, compromise data confidentiality and integrity, and disrupt availability. The lack of integrity checks and use of an abandoned update domain allows injection of malicious code during the update process. Sensitive information is transmitted in cleartext, increasing the risk of interception.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or fix links are provided, users should monitor Ozols Grupa communications for updates. Until a fix is available, disabling or restricting the automatic update mechanism and network access to the abandoned update domain may reduce risk.