Comarch ERP Optima clients connect to the database with a high privileged account, even when users log in with a lower privileged application account. A local attacker who can control the client process can dump its memory, extract the database credentials, and then use those credentials to gain full privileged access to the database. This enables the attacker to read, modify or delete data, potentially compromising confidentiality, integrity, and availability of the entire database system.

The vulnerability affects the Comarch ERP Optima client software. Any installed version prior to the release of version 2026.4 is susceptible. No specific sub‑versions are listed, so all earlier releases that use the default privileged connection logic are considered impacted.

The CVSS score of 7.5 indicates a high severity vulnerability. EPSS data is not available, and the vulnerability is not listed in CISA’s KEV catalog. The exploit requires local access to the client process, so an attacker must already be present on the same machine and have permission to control the client. Once the memory is dumped, credential extraction is trivial, giving the attacker direct privileged database access.