Comarch ERP Optima client makes use of a hard-coded password for a database user.

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

1. May 14, 2026 · NIST NVD

   Detected

   Comarch ERP Optima client makes use of a hard-coded password for a database user. These credentials cannot be changed. It is possible for a remote attacker to gain an access to the database with elevated privileges including executing system commands on a server. This issue has been fixed in version 2026.4

2. Oct 7, 2026 · NIST NVD

   Updated

   Comarch ERP Optima client makes use of a hard-coded password for a database user. These credentials cannot be changed. It is possible for a remote attacker to gain an access to the database with elevated privileges including executing system commands on a server. This issue has been fixed in version 2026.4

Sources

• CVE.orgVulnerability recordCVE-2025-68421

  Official CVE identifier

  cve.org
• NIST NVDVulnerability recordCVE-2025-68421

  Comarch ERP Optima client makes use of a hard-coded password for a database user. These credentials cannot be changed. It is possible for a remote attacker to gain an access to the database with elevated privileges including executing system commands on a server. This issue has b

  nvd.nist.gov

References

• Reference · cert.pl
• Reference · comarch.pl