Hard-Coded SQL Server Admin Password in Bp Premier

Executive Summary

CVE-2026-114119 is a critical vulnerability in Best Practice Software's Bp Premier before version 1.14.1.1128. It involves a hardcoded Microsoft SQL Server administrative password shared across all installations, which cannot be changed without breaking the application. Attackers with network access to the database can exploit this to authenticate as sysadmin, bypass application authentication, and execute operating system commands with SYSTEM privileges.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if your Bp Premier version is before 1.14.1.1128. Verify if the SQL Server instance uses a hardcoded administrative password by inspecting the Bp Premier installation directory for configuration files or database connection strings. Use network scanning tools to identify exposed SQL Server instances and test for default credentials.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows attackers with network access to the database to bypass authentication and gain full administrative control over the system. They can execute arbitrary operating system commands with SYSTEM privileges, potentially leading to complete compromise of the affected system, data theft, or further network infiltration.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability likely violates compliance requirements for GDPR and HIPAA due to insufficient protection of credentials and improper privilege management. It enables unauthorized access to sensitive data, which could result in data breaches and non-compliance with data protection regulations.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately upgrade to Bp Premier version 1.14.1.1129 or later. If upgrading is not possible, restrict network access to the SQL Server listener, apply least privilege to the SQL Server service account, and monitor for anomalous authentication and command execution. Avoid using the hardcoded password.

Useful 0 Not Useful 0