Critical severity · published Oct 21, 2026
CVE-2026-114119
Best Practice Software Bp Premier before 1.14.1.1128 Hardcoded SQL Server Administrative Credential
9.8
CVSS
0.4%
EPSS
No
On KEV
Description
Best Practice Software Bp Premier before 1.14.1.1128 uses a hardcoded Microsoft SQL Server administrative password that is shared across all installations and cannot be changed without breaking the application. Attackers with network access to the database instance can authenticate as sysadmin, bypass application authentication, and execute operating system commands as SYSTEM.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 37% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
BP
Bp Premier · Best Practice Software
before 1.14.1.1128 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-114119
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-114119
def.ci-isac.org.au
https://def.ci-isac.org.au/vuln/records/GCVE-123-2026-0001.json
kb.bestpracticesoftware.com
https://kb.bestpracticesoftware.com/bppremier/oxford/WhatsNew/BpPremier_OxfordSP1_ReleaseNotes.htm
www.vulncheck.com
https://www.vulncheck.com/advisories/best-practice-software-bp-premier-before-1.14.1.1128-hardcoded-sql-server-administrative-credential