CVE-2026-22306 Overview
CVE-2026-22306 is a critical vulnerability in Ozols Grupa OZOLS on Windows caused by an abandoned automatic update domain. The flaw combines three weaknesses: download of code without integrity checks, inclusion of functionality from an untrusted control sphere, and cleartext transmission of sensitive information [CWE-319]. Attackers who register the abandoned domain can serve malicious payloads through the OzolsSQL client update path, the <db>_update SQL Server Agent job using @subsystem = N'ActiveScripting', and the serv_update.vbs script. The vulnerability affects OZOLS versions before 1.1.1233 and requires no authentication or user interaction. Successful exploitation yields code execution in the context of the update process.
Critical Impact
Any actor controlling the abandoned update domain can deliver arbitrary code to OZOLS installations, achieving remote code execution across confidentiality, integrity, and availability boundaries.
Affected Products
- Ozols Grupa OZOLS on Windows before version 1.1.1233
- OzolsSQL client update channel
- serv_update.vbs and the <db>_update SQL Server Agent job
Discovery Timeline
- 2026-08-19 - CVE-2026-22306 published to the National Vulnerability Database
- 2026-08-19 - Last updated in NVD database
Technical Details for CVE-2026-22306
Vulnerability Analysis
The vulnerability originates in the OZOLS automatic update mechanism. The client fetches updates from a domain that the vendor no longer controls. Because the client performs no signature validation or integrity check on downloaded artifacts, any party that registers the abandoned domain becomes a trusted code source. The update workflow also transmits data in cleartext, allowing on-path attackers to observe or alter update traffic. Three distinct components participate in the update chain: the OzolsSQL client update path retrieves binaries, the <db>_update SQL Server Agent job executes ActiveScripting content, and serv_update.vbs runs Visual Basic Script logic. Each step trusts the remote content implicitly.
Root Cause
The root cause is a trust relationship anchored to a DNS name the vendor abandoned. Combined with missing code signing verification and unencrypted transport, the update pipeline treats attacker-controlled files as authoritative. This maps to [CWE-319] cleartext transmission alongside missing integrity verification.
Attack Vector
An attacker registers the abandoned update domain and hosts crafted files matching the paths that OZOLS clients request. When an installed client polls for updates, it downloads and executes the attacker's payload. The ActiveScripting subsystem inside SQL Server Agent runs the delivered script inside the SQL Server service account context, which is frequently privileged. Network-adjacent attackers can also intercept and modify cleartext responses without owning the domain. Refer to the Offseq Research on CVE-2026-22306 for the full exploitation walkthrough.
Detection Methods for CVE-2026-22306
Indicators of Compromise
- Outbound DNS resolution or HTTP requests from OZOLS or SQL Server hosts to the abandoned update domain documented in the Offseq research writeup
- Execution of serv_update.vbs or other VBScript files spawned by sqlagent.exe or cscript.exe
- Creation or modification of SQL Server Agent jobs named <db>_update with @subsystem = N'ActiveScripting'
Detection Strategies
- Inspect SQL Server Agent job history for ActiveScripting steps that download or execute remote content
- Alert on unsigned executables or scripts written to OZOLS installation directories
- Monitor cleartext HTTP requests originating from processes associated with OZOLS or OzolsSQL
Monitoring Recommendations
- Baseline expected outbound destinations for OZOLS hosts and flag deviations, especially requests to update endpoints
- Collect process lineage where sqlagent.exe or sqlservr.exe spawn scripting hosts such as cscript.exe or wscript.exe
- Forward SQL Server Agent logs and Windows Script Host events to a centralized platform for correlation
How to Mitigate CVE-2026-22306
Immediate Actions Required
- Upgrade OZOLS to version 1.1.1233 or later on every Windows host running the client
- Block outbound network access to the abandoned update domain at DNS and firewall layers until patching is complete
- Disable or remove the <db>_update SQL Server Agent job and serv_update.vbs where the auto-update feature is not required
Patch Information
Ozols Grupa addresses the issue in OZOLS 1.1.1233. Details on the fixed release and the deprecated update infrastructure are available in the Offseq Research on CVE-2026-22306.
Workarounds
- Sinkhole the abandoned update domain on internal resolvers to prevent resolution to attacker-controlled infrastructure
- Remove or disable SQL Server Agent jobs that invoke ActiveScripting subsystems tied to the OZOLS update workflow
- Restrict egress from SQL Server hosts to an allowlist of vendor-approved endpoints
# Example: block resolution of the abandoned update domain via Windows hosts file
# Replace abandoned.example with the domain identified in vendor advisory
Add-Content -Path C:\Windows\System32\drivers\etc\hosts -Value "0.0.0.0 abandoned.example"
# Disable the vulnerable SQL Server Agent job
sqlcmd -E -Q "EXEC msdb.dbo.sp_update_job @job_name = N'<db>_update', @enabled = 0;"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
