CVE-2026-114119
Best Practice Software Bp Premier before 1.14.1.1128 Hardcoded SQL Server Administrative Credential
Best Practice Software Bp Premier
CVSS
9.3CriticalExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.43%Chance of exploitation activity in the next 30 days, higher than 36% of CVEs. Scored 23 Oct 2026FIRST EPSS
What fixes it
- 1.14.1.1128Bp PremierCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
Best Practice Software Bp Premier before 1.14.1.1128 uses a hardcoded Microsoft SQL Server administrative password that is shared across all installations and cannot be changed without breaking the application. Attackers with network access to the database instance can authenticate as sysadmin, bypass application authentication, and execute operating system commands as SYSTEM.
Text from CVE List
Affected versions 2
- Bp Premieraffected: all versions before 1.14.1.1128CVE List
- Bp Premierunaffected: 1.14.1.1128CVE List
References 3
- kb.bestpracticesoftware.com/bppremier/oxford/WhatsNew/BpPremier_OxfordSP1_ReleaseNotes.htmFixvia CVE List
- def.ci-isac.org.au/vuln/records/GCVE-123-2026-0001.jsonAdvisoryvia CVE List
- vulncheck.com/advisories/best-practice-software-bp-premier-before-1.14.1.1128-hardcoded-sql-server-administrative-credentialAdvisoryvia CVE List