CVE-2025-68420: CWE-266 Incorrect Privilege Assignment in Comarch ERP Optima
Comarch ERP Optima client connects to a database using a high privileged account regardless of an application account to which a user logs in. It is possible for a local attacker who controls the client process to dump it's memory, extract credentials and use them to gain a privileged access to the database. In order to exploit this vulnerability, the client application has to be already configured, but a user does not have to be logged in. This issue has been fixed in version 2026.4
AI Analysis
Technical Summary
Comarch ERP Optima client software uses a high privileged database account for connections irrespective of the actual application user credentials. This incorrect privilege assignment (CWE-266) allows a local attacker with control over the client process to dump memory, extract the high privileged credentials, and escalate privileges to the database. Exploitation requires the client to be configured but no active user session. The vulnerability has a CVSS 4.0 base score of 7.5 (high severity). The vendor fixed this issue in version 2026.4.
Potential Impact
An attacker with local access to the client system can extract high privileged database credentials from memory, enabling unauthorized privileged access to the database. This could lead to data compromise or unauthorized database operations. No known exploits in the wild have been reported.
Mitigation Recommendations
The vulnerability is fixed in Comarch ERP Optima version 2026.4. Users should upgrade to this version or later to remediate the issue. No official patch or temporary fix details are provided beyond this version update. Until upgrading, restrict local access to client systems to trusted users only.
CVE-2025-68420: CWE-266 Incorrect Privilege Assignment in Comarch ERP Optima
Description
Comarch ERP Optima client connects to a database using a high privileged account regardless of an application account to which a user logs in. It is possible for a local attacker who controls the client process to dump it's memory, extract credentials and use them to gain a privileged access to the database. In order to exploit this vulnerability, the client application has to be already configured, but a user does not have to be logged in. This issue has been fixed in version 2026.4
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Comarch ERP Optima client software uses a high privileged database account for connections irrespective of the actual application user credentials. This incorrect privilege assignment (CWE-266) allows a local attacker with control over the client process to dump memory, extract the high privileged credentials, and escalate privileges to the database. Exploitation requires the client to be configured but no active user session. The vulnerability has a CVSS 4.0 base score of 7.5 (high severity). The vendor fixed this issue in version 2026.4.
Potential Impact
An attacker with local access to the client system can extract high privileged database credentials from memory, enabling unauthorized privileged access to the database. This could lead to data compromise or unauthorized database operations. No known exploits in the wild have been reported.
Mitigation Recommendations
The vulnerability is fixed in Comarch ERP Optima version 2026.4. Users should upgrade to this version or later to remediate the issue. No official patch or temporary fix details are provided beyond this version update. Until upgrading, restrict local access to client systems to trusted users only.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- CERT-PL
- Date Reserved
- 2025-12-17T14:10:16.437Z
- Cvss Version
- 4.0
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a05a966ec166c07b0b5027c
Added to database: 5/14/2026, 10:52:22 AM
Last enriched: 5/14/2026, 11:06:45 AM
Last updated: 5/14/2026, 12:38:12 PM
Views: 7
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.