Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.3

Bp Premier <1.14.1.1128 permits DB admin access

CVE-2026-114119 · published 16 days ago
Summary

Versions of Bp Premier before 1.14.1.1128 contain a built-in SQL Server administrator password that cannot be changed. Anyone who can reach the database on the network can log in as a system administrator and run commands on the server as the operating system's SYSTEM account. Upgrade to version 1.14.1.1128 or later and limit network access to the database to protect against this risk.

What to do
  • Update best practice software bp premier to version 1.14.1.1128 or later.
Affected software
VendorProductAffected versions
best practice software bp premier < 1.14.1.1128
Original advisory text
Best Practice Software Bp Premier before 1.14.1.1128 Hardcoded SQL Server Administrative Credential
Best Practice Software Bp Premier before 1.14.1.1128 uses a hardcoded Microsoft SQL Server administrative password that is shared across all installations and cannot be changed without breaking the application. Attackers with network access to the database instance can authenticate as sysadmin, bypass application authentication, and execute operating system commands as SYSTEM.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker full control
Severity
9.3 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-798Use of Hard-coded Credentials
Timeline
Published21 Oct 2026
Updated4 Nov 2026
First seen21 Oct 2026
Sources
CVE-2026-114119 · NVD
CVE-2026-114119 · MITRE
Track software like this
Free during beta