{"id":"CVE-2026-114119","published":"2026-10-21T01:17:38.353","lastModified":"2026-10-22T17:40:46.877","description":"Best Practice Software Bp Premier before 1.14.1.1128 uses a hardcoded Microsoft SQL Server administrative password that is shared across all installations and cannot be changed without breaking the application. Attackers with network access to the database instance can authenticate as sysadmin, bypass application authentication, and execute operating system commands as SYSTEM.","cvssScore":9.8,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-798"],"vendors":[],"products":[],"references":[{"url":"https://def.ci-isac.org.au/vuln/records/GCVE-123-2026-0001.json","tags":[]},{"url":"https://kb.bestpracticesoftware.com/bppremier/oxford/WhatsNew/BpPremier_OxfordSP1_ReleaseNotes.htm","tags":[]},{"url":"https://www.vulncheck.com/advisories/best-practice-software-bp-premier-before-1.14.1.1128-hardcoded-sql-server-administrative-credential","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"Best Practice Software Bp Premier before 1.14.1.1128 uses a hardcoded Microsoft SQL Server sysadmin password shared across all installations, allowing unauthenticated remote attackers to log in as sysadmin and execute arbitrary OS commands as SYSTEM.","exploitability":"Trivial to exploit over the network with no authentication or user interaction required, provided the attacker can reach the SQL Server port (typically TCP 1433).","blast_radius":"Full system compromise of the host running Bp Premier, including data exfiltration, ransomware deployment, and lateral movement from a privileged SYSTEM account.","remediation":"Upgrade to Bp Premier version 1.14.1.1128 or later, which resolves the hardcoded credential issue.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["hardcoded-credential","sql-injection","rce","auth-bypass","windows"],"model":"garnet-coder","analyzedAt":"2026-10-24T08:54:58.325Z"}}