EUVD-2026-62704

ID: EUVD-2026-62704

Severity: critical

CVSS v4: 10.0 (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H)

CVSS v3: Not provided

CWE: None listed

Source: ENISA

Description

Download of code without integrity check, inclusion of functionality from untrusted control sphere, and cleartext transmission of sensitive information vulnerability in Ozols Grupa OZOLS on Windows caused by an abandoned auto-update domain. Affected component: the automatic update channel - OzolsSQL client update path, the _update SQL Server Agent job (@subsystem = N'ActiveScripting') and serv_update.vbs. This issue affects OZOLS: before 1.1.1233.

Timestamps

Normalized: 2026-08-19T20:06:53Z UTC
Last updated: 2026-08-19T20:06:53Z UTC

References

No references provided.

VulnAI

EUVD-2026-62704

Description

Timestamps

References