CVE-2025-68420 Privilege Escalation in Comarch ERP Optima
Local attackers can extract high-privilege database credentials from the client memory to gain unauthorized privileged access to the database.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-68420?
CVE-2025-68420 is a high-severity vulnerability in Comarch ERP Optima, published on 14 May 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Comarch ERP Optima client connects to a database using a high privileged account regardless of an application account to which a user logs in. It is possible for a local attacker who controls the client process to dump it's memory, extract credentials and use them to gain a privileged access to the database. In order to exploit this vulnerability, the client application has to be already configured, but a user does not have to be logged in. This issue has been fixed in version 2026.4
Weakness: CWE-266
Which versions are affected by CVE-2025-68420?
How do I fix CVE-2025-68420?
No fix has been published for CVE-2025-68420 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-68420 being exploited?
There is no known exploitation of CVE-2025-68420 in the wild and no public exploit code.
Sources
Also known as GHSA-8cw5-3v42-mc6r.