A hard‑coded database user password is embedded in the Comarch ERP Optima client. The password cannot be changed, and the credentials provide elevated database privileges that allow arbitrary execution of system commands on the host. This flaw enables a remote attacker to compromise the confidentiality, integrity, and availability of the database and underlying server.

All installations of Comarch ERP Optima prior to version 2026.4 are vulnerable. The fix was released in version 2026.4 and later releases are not affected.

The issue carries a CVSS score of 8.7, indicating high severity. No EPSS score is available and the vulnerability is not listed in the CISA KEV catalog. The likelihood of exploitation depends on the attacker’s ability to reach the application; the hard‑coded credentials eliminate password management mitigation, making exploitation technically straightforward once the application is accessed.