Comarch ERP Optima contained two critical flaws allowing local memory dumping and remote…
Comarch ERP Optima contained two critical flaws allowing local memory dumping and remote database compromise via hardcoded credentials, patched in version 2026.4.
CERT Polska coordinated disclosure of two vulnerabilities in Comarch ERP Optima software. CVE-2025-68420 allows local attackers to extract high-privileged database credentials from the client process memory, even when no user is logged in, provided the client is configured. CVE-2025-68421 involves hardcoded database credentials that cannot be changed, enabling remote attackers to access the database with elevated privileges and execute system commands on the server.
Both vulnerabilities represent significant risks to organizations using Comarch ERP Optima, particularly CVE-2025-68421 which enables remote exploitation without prior authentication. The hardcoded credential issue permits direct database access and operating system command execution, potentially leading to complete system compromise.
Comarch has addressed both issues in version 2026.4. Organizations running earlier versions should prioritize upgrading immediately. The vulnerabilities were responsibly disclosed by Wojciech Giełda through CERT Polska's coordinated vulnerability disclosure process.
Mentioned in this report
Detection guidance
SQL Server Spawning Command Interpreter (Potential xp_cmdshell Abuse via Hardcoded DB Credentials)
Detects sqlservr.exe (SQL Server process) spawning a command shell or scripting interpreter, a pattern consistent with remote OS command execution after authenticating with hardcoded/high-privilege database credentials (CVE-2025-68421 style attack chain). Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: SQL Server Process Spawning Command Shell
id: 1567ab0e-eded-5186-a27e-baa6b5593dd4
status: experimental
description: Detects sqlservr.exe spawning cmd.exe, powershell.exe, or other scripting
interpreters, indicative of xp_cmdshell or similar OS command execution abuse following
database authentication with elevated/hardcoded credentials.
logsource:
category: process_creation
product: windows
detection:
selection:
ParentImage|endswith: \\sqlservr.exe
Image|endswith:
- \\cmd.exe
- \\powershell.exe
- \\pwsh.exe
- \\wscript.exe
- \\cscript.exe
filter_maintenance:
CommandLine|contains:
- sqlagent
- backup
condition: selection and not filter_maintenance
falsepositives:
- Scheduled SQL Server Agent maintenance jobs that legitimately invoke command-line
utilities
- DBA-authored stored procedures intentionally calling xp_cmdshell for administrative
tasks
level: high
tags:
- attack.t1059
- attack.execution
author: Vorant
Non-Standard Process Reading ERP Optima Credential Configuration Files
Detects processes other than the expected ERP client binaries opening configuration files associated with Comarch ERP Optima that typically store database connection strings/credentials, which may indicate credential harvesting from files. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Suspicious Access to ERP Optima Credential Config Files
id: 57418339-b142-5951-9da3-a02e2e02a28d
status: experimental
description: Detects file access to Comarch ERP Optima configuration files likely
to contain database connection strings/credentials, performed by processes not typically
associated with the ERP client (e.g. scripting engines, archivers, or general-purpose
editors), suggesting credential harvesting from files.
logsource:
category: file_event
product: windows
detection:
selection:
TargetFilename|contains:
- Optima
TargetFilename|endswith:
- .config
- .ini
- .xml
suspicious_process:
Image|endswith:
- \\powershell.exe
- \\pwsh.exe
- \\cmd.exe
- \\wscript.exe
- \\cscript.exe
- \\notepad.exe
condition: selection and suspicious_process
falsepositives:
- IT administrators or backup scripts routinely opening ERP configuration files for
legitimate maintenance
- Vendor support tools reading configuration files during troubleshooting sessions
level: medium
tags:
- attack.t1552.001
- attack.credential_access
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://cert.pl/en/posts/2026/05/CVE-2025-68420
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free