# Comarch ERP Optima flaws expose database credentials

Published: 2026-05-14 · Severity: high
Canonical: https://vorant.io/reports/d0505eff-fc5d-5ea8-a3bb-3b7d2840a904/comarch-erp-optima-flaws-expose-database-credentials

> Two vulnerabilities in Comarch ERP Optima allow local memory dumping and hardcoded password exploitation to gain privileged database access, fixed in version 2026.4.

CERT Polska disclosed two vulnerabilities in Comarch ERP Optima software following coordinated disclosure. CVE-2025-68420 allows local attackers to dump client process memory and extract high-privileged database credentials, requiring only that the client be configured but not necessarily logged in. CVE-2025-68421 involves a hardcoded database password that cannot be changed, enabling remote attackers to access the database with elevated privileges including system command execution capabilities.

Both vulnerabilities provide paths to privileged database access in ERP Optima deployments. The local memory-dumping flaw requires attacker control of the client process, while the hardcoded credential issue can be exploited remotely without such prerequisites. Comarch addressed both issues in version 2026.4.

The vulnerabilities were responsibly disclosed by researcher Wojciech Giełda through CERT Polska's coordinated vulnerability disclosure process. Organizations running Comarch ERP Optima should upgrade to version 2026.4 or later to remediate these issues.

## Mentioned in this report

- Vulnerabilities: CVE-2025-68420, CVE-2025-68421

## Detection guidance (public sample)

### Process Memory Dumping via comsvcs.dll MiniDump (Credential Extraction from Application Client)

ATT&CK: T1003.007

Detects use of the classic MiniDump export in comsvcs.dll via rundll32 to dump a running process's memory, a technique usable to extract in-memory database credentials from an ERP client process such as Comarch ERP Optima. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Process Memory Dump via comsvcs.dll MiniDump
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: \rundll32.exe
    CommandLine|contains|all:
    - comsvcs.dll
    - MiniDump
  condition: selection
falsepositives:
- Legitimate administrator-driven memory dump troubleshooting using documented procedures
- Endpoint security or crash-reporting tooling invoking comsvcs.dll for diagnostic
  dumps
level: high
tags:
- attack.credential_access
- attack.t1003.007
id: 6eedc460-27c3-5e45-8251-b685f044676f
status: experimental
author: Vorant
```

### Shell/Command Interpreter Spawned by Database Server Process

ATT&CK: T1059

Detects a command or scripting interpreter (cmd.exe, powershell.exe, sh, bash) being spawned as a child of a database engine process, indicative of remote command execution abuse via elevated/hardcoded database credentials as described for CVE-2025-68421. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Command Interpreter Child Process of Database Server
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|contains:
    - sqlservr.exe
    - fbserver.exe
    - firebird.exe
    - ibserver.exe
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \pwsh.exe
    - \wscript.exe
    - \cscript.exe
  condition: selection
falsepositives:
- Scheduled database maintenance scripts legitimately invoking shell utilities from
  the DB service account
- Backup or monitoring agents that spawn helper scripts from the database process
level: medium
tags:
- attack.execution
- attack.t1059
id: 1bfae27f-a829-5c35-8251-6cd6444fa073
status: experimental
author: Vorant
```

### Command-Line Search for Plaintext Credentials in Application Configuration Files

ATT&CK: T1552.001

Detects use of text-search utilities (findstr, grep, select-string) scanning application/config directories for stored plaintext credential strings such as password or connection-string keywords, consistent with harvesting hardcoded or stored database credentials from ERP client configuration. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Credential Keyword Search Across Config Files
logsource:
  category: process_creation
  product: windows
detection:
  selection_tool:
    Image|endswith:
    - \findstr.exe
    - \powershell.exe
    - \pwsh.exe
  selection_keywords:
    CommandLine|contains:
    - password
    - pwd=
    - connectionstring
    - conn_string
  selection_scope:
    CommandLine|contains:
    - .ini
    - .config
    - .xml
    - .cfg
  condition: all of selection_*
falsepositives:
- IT administrators auditing configuration files for exposed secrets as part of hardening
  reviews
- Automated configuration-management or compliance-scanning tools searching config
  directories
level: medium
tags:
- attack.credential_access
- attack.t1552.001
id: 7592357f-acfd-58f7-a577-d71ee1cb2337
status: experimental
author: Vorant
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://cert.pl/en/posts/2026/05/CVE-2025-68420

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/d0505eff-fc5d-5ea8-a3bb-3b7d2840a904/comarch-erp-optima-flaws-expose-database-credentials.
Full IOC sets, deployable detections, the entity graph, TAXII 2.1 feed and real-time alerts: https://vorant.io/signup