OZOLS software contains a critical supply chain vulnerability due to an abandoned update domain, enabling unauthenticated remote code execution.

The application uses an abandoned domain for its automatic update channel, which lacks integrity checks. An attacker can intercept this channel to deliver malicious updates that are executed with high privileges by the SQL Server Agent or the client update process.

With a CVSS score of 10.0, this vulnerability allows for the total compromise of systems running the OZOLS software. The ability to push unauthorized code via the update mechanism poses a systemic risk to all internal systems that rely on this software for database and server management.

Immediate Action: Update the OZOLS software to version 1.1.1233 or higher to resolve the insecure update channel configuration.

Proactive Monitoring: Audit logs for the SQL Server Agent and the OzolsSQL client update path for any unexpected script execution or connection attempts to unauthorized domains.

Compensating Controls: Block outbound traffic from the application server to the compromised domain and ensure the software is restricted to a segmented network environment.

Public Exploit Available: No

This vulnerability is highly severe because it exploits a trusted update mechanism. Organizations should update the software immediately and consider auditing all recent update activities to ensure no malicious code was introduced prior to patching.