External risk intelligence

Ozols SQL Client Update Domain Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 10.0)

CVE-2026-22306

The vulnerability resides in a local client-side automatic update mechanism for a specific desktop software application. These update channels typically operate within the internal environment of the host machine and are not intended to be directly exposed as internet-facing services or gateways in normal deployments.

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability has been identified in Ozols Grupa OZOLS on Windows, stemming from an abandoned auto-update domain that could allow for the download of code without proper integrity checks, the inclusion of untrusted functionality, and the transmission of sensitive information in cleartext. This issue specifically impacts the automatic update channel, the OzolsSQL client update path, and related SQL Server Agent jobs and scripts.

Unchecked software updates could expose systems.
Attackers could potentially gain unauthorized access.
Confirm relevance and assess potential exposure.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by leveraging an abandoned auto-update domain to deliver malicious code. This could occur if the software attempts to update itself from a compromised or specially crafted domain, leading to the execution of arbitrary code and potential compromise of sensitive information.

No specific access required.
Triggered by an automatic update.
Risk of code execution and data compromise.

Live Threat

Current exploitation, exposure, and threat context

The Ozols SQL client's auto-update functionality could be compromised due to an abandoned update domain. This could lead to the download and installation of unauthorized code, potentially affecting the integrity and behavior of the SQL Server Agent job and related update scripts on Windows systems.

System integrity and code execution.
Untrusted code downloaded via update.
Compromised server agent job execution.

Operational Fix

Recommended remediation, mitigation, and detection steps

The Ozols Grupa OZOLS automatic update channel, the OzolsSQL client update path, and the _update SQL Server Agent job are affected by this vulnerability. Responsibility likely falls to application owners and infrastructure or platform teams who manage these components. The first step is to identify all instances of the affected technology, confirm their business criticality and network reachability, and then engage the accountable owner to plan remediation.

Identify accountable teams and owners.
Verify active deployments and exposure.
Plan coordinated remediation efforts.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Ozols Grupa OZOLS software?

OZOLS is a business management and accounting software suite for Windows. It includes client-side components like the OzolsSQL client and backend database tasks. These tools rely on background processes, such as SQL Server Agent jobs and specialized scripts like serv_update.vbs, to maintain system synchronization and perform automated updates.

What does CWE-494, CWE-829, and CWE-319 mean for CVE-2026-22306?

These codes identify weaknesses in how software handles updates. CVE-2026-22306 occurs because the update mechanism lacks integrity checks, meaning it does not verify if downloaded files are legitimate (CWE-494). It also pulls functionality from untrusted sources (CWE-829) and sends data in cleartext (CWE-319), leaving the update process vulnerable to interception or redirection.

How is the update mechanism triggered?

The vulnerability is triggered when the software's automated update process attempts to reach its update server. Because the domain used for these updates has been abandoned, an attacker could potentially mimic that domain. Simply using the software normally is enough to initiate this check. The bug is not triggered if the update mechanism is disabled or if the system cannot reach the network path associated with the abandoned domain.

Do I need to worry about this if my software is internal?

Halo Surface Signal indicates this is unlikely to be internet-facing, as it typically functions within a local environment. However, any system running an affected version of OZOLS is theoretically at risk if the application performs its automatic update check. While it is not a direct gateway service, evaluate whether your internal network could allow an attacker to intercept or redirect these local update requests.

What should I do first to address this?

Start by identifying all Windows machines running versions of OZOLS earlier than 1.1.1233. Verify which systems have the automatic update feature enabled and where the related SQL Server Agent jobs are configured. Once you have a list of active deployments, contact your application owners to plan for an update to the secure, supported version of the software to resolve the integrity risks.

References

offseq.com/en/research/ozols-cve-2026-22306

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.