Comarch ERP Optima client connects to a database using a high privileged account regardless of an application account to which a user logs in.

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

1. May 14, 2026 · NIST NVD

   Detected

   Comarch ERP Optima client connects to a database using a high privileged account regardless of an application account to which a user logs in. It is possible for a local attacker who controls the client process to dump it's memory, extract credentials and use them to gain a privileged access to the database. In order to exploit this vulnerability, the client application has to be already configure

2. Oct 7, 2026 · NIST NVD

   Updated

   Comarch ERP Optima client connects to a database using a high privileged account regardless of an application account to which a user logs in. It is possible for a local attacker who controls the client process to dump it's memory, extract credentials and use them to gain a privileged access to the database. In order to exploit this vulnerability, the client application has to be already configure

Sources

• CVE.orgVulnerability recordCVE-2025-68420

  Official CVE identifier

  cve.org
• NIST NVDVulnerability recordCVE-2025-68420

  Comarch ERP Optima client connects to a database using a high privileged account regardless of an application account to which a user logs in. It is possible for a local attacker who controls the client process to dump it's memory, extract credentials and use them to gain a privi

  nvd.nist.gov

References

• Reference · cert.pl
• Reference · comarch.pl