CVE-2026-114119

9.8 CRITICAL

Published 2026-10-21 · Updated 2026-10-22

AI risk analysis

Summary: Best Practice Software Bp Premier before 1.14.1.1128 uses a hardcoded Microsoft SQL Server sysadmin password shared across all installations, allowing unauthenticated remote attackers to log in as sysadmin and execute arbitrary OS commands as SYSTEM.
Exploitability: Trivial to exploit over the network with no authentication or user interaction required, provided the attacker can reach the SQL Server port (typically TCP 1433).
Blast radius: Full system compromise of the host running Bp Premier, including data exfiltration, ransomware deployment, and lateral movement from a privileged SYSTEM account.
Detection: No reliable host or network indicator is derivable from the published description.
Prioritized remediation: Upgrade to Bp Premier version 1.14.1.1128 or later, which resolves the hardcoded credential issue.

hardcoded-credentialsql-injectionrceauth-bypasswindows

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.

NVD description

Best Practice Software Bp Premier before 1.14.1.1128 uses a hardcoded Microsoft SQL Server administrative password that is shared across all installations and cannot be changed without breaking the application. Attackers with network access to the database instance can authenticate as sysadmin, bypass application authentication, and execute operating system commands as SYSTEM.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-798

All references

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

Related by shared AI tags and CWE weakness class. Browse the full archive.