VulnSocial

CVE-2025-68420Disclosure

LOWCVSS 7.5 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

Comarch ERP Optima client connects to a database using a high privileged account regardless of an application account to which a user logs in. It is possible for a local attacker who controls the client process to dump it's memory, extract credentials and use them to gain a privileged access to the database. In order to exploit this vulnerability, the client application has to be already configured, but a user does not have to be logged in.  This issue has been fixed in version 2026.4

Back to dashboard
0.0/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-266

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Threat summary

  • 1 mentions across 1 observed day

What's happening

  • Disclosure: 1 classified signal
  • 1 total mentions across 1 day

Deep dive

Activity timeline1 mentions / 1d
00111Mentions · 2026-05-14: 105-14
Signal classification1 categories
Disclosure
1100.0%
Referenced assets1 URL
Full discourse1 post
  • TodayInCyber@TodayInCyberIO
    Disclosure

    🟠 HIGH | CERT Polska coordinated the disclosure of two critical vulnerabilities, CVE-2025-68420 and CVE-2025-68421, affecting Comarch ERP Optima software #vulnerability #CVE202568420 #CVE202568421 #cybersecurity https://todayincyber.io/feed/vulnerability/article/019e260a-fffa-7d9a-953d-45e5a76a7fe1

    Post summary

    CERT Polska has announced the coordinated disclosure of two critical vulnerabilities (CVE‑2025‑68420/68421) affecting Comarch ERP Optima software; no exploitation or mitigation details are provided.

    0304090
    10 followersView on X

Explore more

Back to dashboard