CVE-2026-114119
Best Practice Software Bp Premier before 1.14.1.1128 uses a hardcoded Microsoft SQL Server…
- Risk score
- 71/100
- CVSS
- 9.8 v3.1
- Exploit chance (30 days)
- 0.4%
- Published
- 21 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- Best Practice Software Bp Premier uses a hardcoded Microsoft SQL Server administrative password that is shared across all installations, allowing attackers to authenticate as sysadmin and execute operating system commands as SYSTEM.
- Affected
- {'products': ['Best Practice Software Bp Premier'], 'packages': [], 'versions': ['before 1.14.1.1128']}
- Fix
- Check the linked advisory for the concrete fix, as none is provided in this record.
- Exploitation
- No known exploitation
Why it is Amber
- CVSS 9.8 critical
- Remotely exploitable without logging in
References
Original description
Best Practice Software Bp Premier before 1.14.1.1128 uses a hardcoded Microsoft SQL Server administrative password that is shared across all installations and cannot be changed without breaking the application. Attackers with network access to the database instance can authenticate as sysadmin, bypass application authentication, and execute operating system commands as SYSTEM.
Last activity 21 Oct 2026. Patch Forecast updates every hour.