EUVD-2026-62704
GHSA-xhj7-3r6j-f89h
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Unauthenticated network delivery via an automated update job with no interaction (PR:N/UI:N), reliable once the lapsed domain is registered (AC:L), and code runs in the elevated agent context affecting the whole host (S:C, C/I/A:H).
Primary rating from Vendor (ENISA).
CVSS VectorVendor: ENISA
Lifecycle Timeline
3DescriptionCVE.org
Download of code without integrity check, inclusion of functionality from untrusted control sphere, and cleartext transmission of sensitive information vulnerability in Ozols Grupa OZOLS on Windows caused by an abandoned auto-update domain. Affected component: the automatic update channel - OzolsSQL client update path, the <db>_update SQL Server Agent job (@subsystem = N'ActiveScripting') and serv_update.vbs.
This issue affects OZOLS: before 1.1.1233.
AnalysisAI
Remote code execution in Ozols Grupa OZOLS on Windows (all versions before 1.1.1233) stems from an abandoned automatic-update domain that the OzolsSQL client still trusts. Because updates are pulled over cleartext with no integrity or signature check, anyone who re-registers the lapsed domain (or performs a network MITM) can serve a malicious serv_update.vbs that the <db>_update SQL Server Agent job executes as ActiveScripting, yielding full host compromise. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the OZOLS installation (any version before 1.1.1233 on Windows) still points its OzolsSQL update path at the abandoned vendor update domain - the default configuration - and that the <db>_update SQL Server Agent job with @subsystem = N'ActiveScripting' is present and enabled so serv_update.vbs is fetched and run automatically. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine top-priority issue rather than an inflated high-CVSS score. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Patch available per vendor advisory: upgrade OZOLS to version 1.1.1233 or later, which is the first release outside the affected range and is the primary fix. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all systems running Ozols Grupa OZOLS on Windows and identify affected versions prior to 1.1.1233 using your asset management system. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-494 – Download of Code Without Integrity Check
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today