Best Practice Software Bp Premier versions before 1.14.1.1128 ship with a hardcoded Microsoft SQL Server administrative password that is shared across all installations. According to the NVD description, an attacker who can reach the database over the network could use it to run operating system commands as SYSTEM.
What Is It
CVE-2026-114119 is a hardcoded credentials flaw (CWE-798) in Best Practice Software's Bp Premier. The application uses a single Microsoft SQL Server administrative password that is the same on every installation. Per the NVD description, the password cannot be changed without breaking the application, so administrators cannot rotate it.
According to the NVD description, an attacker who can reach the database instance over the network could authenticate as sysadmin, bypass application authentication, and execute operating system commands as SYSTEM.
Why It Matters
- CVSS 3.1: 9.8 CRITICAL (
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) - CVSS 4.0: 9.3 CRITICAL (secondary score from VulnCheck)
The attack is network-based, has low complexity, and needs no privileges or user interaction. Because every installation uses the same credential, one disclosed password could affect every unpatched deployment. A successful attacker could gain full sysadmin control of the database and SYSTEM-level command execution on the host, so confidentiality, integrity and availability are all rated high.
Exploitation status: CVE-2026-114119 is not currently in the CISA Known Exploited Vulnerabilities (KEV) catalog. The supplied data does not confirm active exploitation, and there is no KEV-mandated remediation deadline.
What's Vulnerable
- Vendor: Best Practice Software
- Product: Bp Premier
- Affected: all versions before 1.14.1.1128
- Unaffected: version 1.14.1.1128
Risk is highest where the Bp Premier SQL Server instance can be reached by untrusted hosts on the network.
Patch Status
The issue is fixed in Bp Premier 1.14.1.1128. Organizations running earlier versions should upgrade to 1.14.1.1128 or later. The vendor's reference is the Bp Premier Oxford SP1 release notes, linked below.
The password cannot be changed safely on vulnerable versions, so upgrading is the only fix named in the source material. The NVD record has "Received" status, and NVD has not yet completed its analysis.