OZOLS ERP RCE via Abandoned Domain CVE-2026-22306 Analysis and POC

Vulnerability Overview CVE-2026-22306 is a critical remote code execution (RCE) vulnerability found in the OZOLS ERP system. The vulnerability stems from OZOLS’ automatic update channel, which downloads and executes code from the abandoned domain . Since the domain has expired and no signature, hash, or certificate checks are performed, an attacker can register the domain to execute arbitrary code. OffSeq registered the domain defensively to prevent malicious takeover and coordinated the disclosure with CERT.LV. Impact Scope Affected Systems: OZOLS (OzolsSQL) for Windows, using the legacy update host. Severity: CVSS 4.0 Base Score 10.0 (Critical); CVSS 3.1 Base Score 10.0 (Critical). Attack Vector: Network-based, low complexity, requires no privileges or user interaction. Consequences: Complete system compromise. The code executes under the SQL Server service account, providing full control over accounting and ERP databases, and propagates to all workstations via . Remediation Fix Status: Patched by the vendor; CVE assigned. Disclosure: Coordinated through CERT.LV. Vulnerability Details Update Channel Mechanism 1. Update Trigger: Initiated from the customer's SQL Server. 2. SQL Server Agent Job: The job uses to retrieve files from a fixed path via the WebDAV provider. 3. Files Downloaded: , , , . 4. Version Check: Performs only a numerical comparison; lacks TLS enforcement, code signing, checksums, or validation. 5. Execution: extracts into the table of the SQL database. The client extracts and runs the content upon startup. Root Cause Abandoned Domain: has expired and is freely available for registration. Lack of Integrity Controls: Absence of transport security, source host authenticity verification, signed/hashed packages, or a trusted extractor. Proof of Concept (POC) 1. Domain Registration: OffSeq defensively registered , , and . 2. Malicious Update Server: A WebDAV/HTTP server was set up to serve a higher version number and a benign payload. 3. POC Code: 4. Triggering the Update: 5. Result: appeared on the SQL Server, proving code execution; was inserted into the table, confirming propagation. Impact and Severity CVSS Scores: - CVSS 4.0: - CVSS 3.1: Attack Characteristics: Network-based, low complexity, no privileges or user interaction required. Consequences: Complete compromise. Code runs as the SQL Server service account, granting full control over the database and ERP, with propagation to workstations via . Disclosure Timeline Coordination: Coordinated via CERT.LV. Status: Patched; CVE assigned. Summary This vulnerability represents a critical remote code execution risk within the OZOLS ERP system, caused by its automatic update channel fetching code from an abandoned domain. An attacker can register the domain to execute arbitrary code, resulting in full system compromise. OffSeq registered the domain defensively to prevent malicious takeover and coordinated the vulnerability disclosure with CERT.LV.

Goal Reached Thanks to every supporter — we hit 100%!

OZOLS ERP RCE via Abandoned Domain CVE-2026-22306 Analysis and POC