Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.

CVE-2026-114119 Details

ANALYZED

This CVE record has been analyzed and enriched by NVDAPI.com as an independent party.

Description

Best Practice Software Bp Premier before 1.14.1.1128 uses a hardcoded Microsoft SQL Server administrative password that is shared across all installations and cannot be changed without breaking the application. Attackers with network access to the database instance can authenticate as sysadmin, bypass application authentication, and execute operating system commands as SYSTEM.

Metrics

CVSS 3.x Severity and Vector Strings:

VolerionCVSS-B:8.8 HIGHVector:CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CNA: [email protected]CVSS-B:9.8 CRITICALVector:CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URL	Source(s)	Tag(s)
https://def.ci-isac.org.au/vuln/records/GCVE-123-2026-0001.json	[email protected]	AdvisoryRemedy
https://kb.bestpracticesoftware.com/bppremier/oxford/WhatsNew/BpPremier_OxfordSP1_ReleaseNotes.htm	[email protected]	Release NotesVendor
https://www.vulncheck.com/advisories/best-practice-software-bp-premier-before-1.14.1.1128-hardcoded-sql-server-administrative-credential	[email protected]	Advisory

Weakness Enumeration

CWE-ID	CWE Name	Source
CWE-798	Use of Hard-coded Credentials	[email protected]

Affected Products

Product	Versions
Best Practice Software Bp Premier	>= 0, < 1.14.1.1128
CPE No CPEs found in CPE dictionary for this product. Remediation Upgrade: 1.14.1.1129moderate effort Workaround:low effort Restrict network access to the Bp Premier SQL Server listener so it is reachable only from the Bp Premier server. Do not expose the SQL Server listener to untrusted networks, remote-access paths, or the public internet. Apply least privilege to the SQL Server service account where the deployment supports it. Monitor for anomalous direct SQL Server authentication and for enabling of operating-system command execution features.

Product

Versions

Best Practice Software Bp Premier

>= 0, < 1.14.1.1128

CPE

No CPEs found in CPE dictionary for this product.

Remediation

Upgrade: 1.14.1.1129moderate effort
Workaround:low effort
Restrict network access to the Bp Premier SQL Server listener so it is reachable only from the Bp Premier server. Do not expose the SQL Server listener to untrusted networks, remote-access paths, or the public internet. Apply least privilege to the SQL Server service account where the deployment supports it. Monitor for anomalous direct SQL Server authentication and for enabling of operating-system command execution features.

Change History

2 change records found show changes

Date	Action	Recorded By
Oct 28, 2026	CVE Modified	CISA-ADP
Oct 21, 2026	New CVE Received	[email protected]