---
id: CVE-2026-114119
title: >-
  Best Practice Software Bp Premier before 1.14.1.1128 Hardcoded SQL Server
  Administrative Credential
summary: >-
  Best Practice Software Bp Premier before 1.14.1.1128 uses a hardcoded
  Microsoft SQL Server administrative password that is shared across all
  installations and cannot be changed without breaking the application.
  Attackers with network acc…
severity: critical
cvss: 9.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
cwe:
  - CWE-798
vendor: Best Practice Software
product: Bp Premier
affected:
  - bp_premier < 1.14.1.1128
published: '2026-10-21'
updated: '2026-10-21'
sourceUpdated: '2026-10-21T00:37:16.230Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-114119'
references:
  - url: >-
      https://kb.bestpracticesoftware.com/bppremier/oxford/WhatsNew/BpPremier_OxfordSP1_ReleaseNotes.htm
    label: Bp Premier Oxford SP1 Release Notes
  - url: 'https://def.ci-isac.org.au/vuln/records/GCVE-123-2026-0001.json'
    label: CI-ISAC Australia GCVE-123-2026-0001
  - url: >-
      https://www.vulncheck.com/advisories/best-practice-software-bp-premier-before-1.14.1.1128-hardcoded-sql-server-administrative-credential
    label: >-
      VulnCheck Advisory: Best Practice Software Bp Premier before 1.14.1.1128
      Hardcoded SQL Server Administrative Credential
tags:
  - cve.org
ingestedAt: '2026-10-21T01:37:08.008Z'
---

## Overview

Best Practice Software Bp Premier before 1.14.1.1128 uses a hardcoded Microsoft SQL Server administrative password that is shared across all installations and cannot be changed without breaking the application. Attackers with network access to the database instance can authenticate as sysadmin, bypass application authentication, and execute operating system commands as SYSTEM.

## Affected

- `bp_premier < 1.14.1.1128`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.