Ozols Grupa vulnerabilities and threats

CVE-2026-22306 is a critical vulnerability in Ozols Grupa's OZOLS product prior to version 1.1.1233. It involves the download of code without integrity checks, inclusion of functionality from an untrusted control sphere, and cleartext transmission of sensitive information. The issue stems from an abandoned auto-update domain affecting the automatic update channel, specifically the OzolsSQL client update path, a SQL Server Agent job, and a VBScript file. This vulnerability allows remote attackers to potentially execute arbitrary code without user interaction and without requiring privileges.