CVE-2025-68421

High

Published: 14/05/2026(UTC)Translated: 15/06/2026(UTC)NVD NIST

Summary

The Comarch ERP Optima client uses a hard-coded password for a database user that cannot be changed. A remote attacker can gain access to the database with elevated privileges, including executing system commands on the server.

Risk Assessment

The organization is at significant risk as an attacker could gain full access to the database and system, potentially leading to data loss or server takeover.

Recommendation

It is recommended to upgrade to version 2026.4, where the issue has been fixed, to minimize the risk of unauthorized access.

Other vulnerabilities in Comarch ERP Optima

CVE-2025-68420High
The Comarch ERP Optima client connects to a database using a high privileged account regardless of the application account the user logs into. A local attacker controlling the client process can dump its memory, extract credentials, and gain privileged access to the database.

Original NVD description (English source)

Comarch ERP Optima client makes use of a hard-coded password for a database user. These credentials cannot be changed. It is possible for a remote attacker to gain an access to the database with elevated privileges including executing system commands on a server. This issue has been fixed in version 2026.4