PT-2026-40903 · Comarch · Erp Optima

Wojciech Giełda · Published 2026-05-14 · Updated 2026-05-14 · CVE-2025-68421

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Comarch ERP Optima versions prior to 2026.4

Description The client uses a hard-coded password for a database user that cannot be changed. This allows a remote attacker to gain access to the database with elevated privileges, which may include the ability to execute system commands on the server.

Recommendations Update to version 2026.4.

Fix

Using Hardcoded Credentials

Weakness Enumeration

CWE-798

Related Identifiers

CVE-2025-68421

Affected Products

Erp Optima

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2025-68421 · Security Note
• https://cert.pl/posts/2026/05/CVE-2025-68420 · Note
• https://t.me/CVEtracker/53774 · Telegram Post
• https://t.me/cveNotify/163427 · Telegram Post
• https://comarch.pl/erp/comarch-optima · Note