Comarch ERP Optima patches critical memory and database flaws
Comarch ERP Optima contained two critical flaws allowing local memory dumping and remote database compromise via hardcoded credentials, patched in version 2026.4.
Sourcecert.pl — open the original
What to check
- Applies to
- The 2 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- No exploitation in the wild and no public exploit is recorded for the CVEs named.
CERT Polska coordinated disclosure of two vulnerabilities in Comarch ERP Optima software. CVE-2025-68420 allows local attackers to extract high-privileged database credentials from the client process memory, even when no user is logged in, provided the client is configured. CVE-2025-68421 involves hardcoded database credentials that cannot be changed, enabling remote attackers to access the database with elevated privileges and execute system commands on the server.
Both vulnerabilities represent significant risks to organizations using Comarch ERP Optima, particularly CVE-2025-68421 which enables remote exploitation without prior authentication. The hardcoded credential issue permits direct database access and operating system command execution, potentially leading to complete system compromise.
Comarch has addressed both issues in version 2026.4. Organizations running earlier versions should prioritize upgrading immediately. The vulnerabilities were responsibly disclosed by Wojciech Giełda through CERT Polska's coordinated vulnerability disclosure process.
Mentioned in this report
Detection guidance
SQL Server Spawning Command Interpreter (Potential xp_cmdshell Abuse via Hardcoded DB Credentials)
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects sqlservr.exe (SQL Server process) spawning a command shell or scripting interpreter, a pattern consistent with remote OS command execution after authenticating with hardcoded/high-privilege database credentials (CVE-2025-68421 style attack chain). Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: SQL Server Process Spawning Command Shell
id: 1567ab0e-eded-5186-a27e-baa6b5593dd4
status: experimental
description: Detects sqlservr.exe spawning cmd.exe, powershell.exe, or other scripting
interpreters, indicative of xp_cmdshell or similar OS command execution abuse following
database authentication with elevated/hardcoded credentials.
logsource:
category: process_creation
product: windows
detection:
selection:
ParentImage|endswith: \\sqlservr.exe
Image|endswith:
- \\cmd.exe
- \\powershell.exe
- \\pwsh.exe
- \\wscript.exe
- \\cscript.exe
filter_maintenance:
CommandLine|contains:
- sqlagent
- backup
condition: selection and not filter_maintenance
falsepositives:
- Scheduled SQL Server Agent maintenance jobs that legitimately invoke command-line
utilities
- DBA-authored stored procedures intentionally calling xp_cmdshell for administrative
tasks
level: high
tags:
- attack.t1059
- attack.execution
author: Vorant
Non-Standard Process Reading ERP Optima Credential Configuration Files
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects processes other than the expected ERP client binaries opening configuration files associated with Comarch ERP Optima that typically store database connection strings/credentials, which may indicate credential harvesting from files. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Suspicious Access to ERP Optima Credential Config Files
id: 57418339-b142-5951-9da3-a02e2e02a28d
status: experimental
description: Detects file access to Comarch ERP Optima configuration files likely
to contain database connection strings/credentials, performed by processes not typically
associated with the ERP client (e.g. scripting engines, archivers, or general-purpose
editors), suggesting credential harvesting from files.
logsource:
category: file_event
product: windows
detection:
selection:
TargetFilename|contains:
- Optima
TargetFilename|endswith:
- .config
- .ini
- .xml
suspicious_process:
Image|endswith:
- \\powershell.exe
- \\pwsh.exe
- \\cmd.exe
- \\wscript.exe
- \\cscript.exe
- \\notepad.exe
condition: selection and suspicious_process
falsepositives:
- IT administrators or backup scripts routinely opening ERP configuration files for
legitimate maintenance
- Vendor support tools reading configuration files during troubleshooting sessions
level: medium
tags:
- attack.t1552.001
- attack.credential-access
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://cert.pl/en/posts/2026/05/CVE-2025-68420
Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,436 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs