Comarch ERP Optima hardcoded DB credential flaws
Comarch ERP Optima had two vulnerabilities allowing credential theft and remote database compromise via a hardcoded account, now patched in version 2026.4.
Sourcecert.pl — open the original
What to check
- Applies to
- The 2 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- No exploitation in the wild and no public exploit is recorded for the CVEs named.
CERT Polska coordinated disclosure of two vulnerabilities in Comarch ERP Optima, an enterprise resource planning client used by businesses. CVE-2025-68420 stems from the client connecting to its backend database using a high-privileged account regardless of the logged-in application user; a local attacker with access to the client process could dump memory to extract these database credentials, requiring only that the client be configured (not necessarily logged in). CVE-2025-68421 is more severe: the client uses a hard-coded database password that cannot be changed, allowing a remote attacker to authenticate to the database with elevated privileges, including the ability to execute system commands on the server.
Both issues were fixed in Comarch ERP Optima version 2026.4. There is no indication of active exploitation in the wild; this is a responsibly disclosed vulnerability report credited to researcher Wojciech Giełda, handled through CERT Polska's coordinated vulnerability disclosure process. Organizations running affected versions should prioritize patching, as the hard-coded credential (CVE-2025-68421) presents a straightforward path to remote database and potential server compromise.
Mentioned in this report
Source reporting: https://cert.pl/en/posts/2026/05/CVE-2025-68420
Free public brief. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them, no card.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,436 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs