Hardcoded SQL Server admin password in Best Practice Software Bp Premier
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-798.
Summary
Best Practice Software Bp Premier before 1.14.1.1128 uses a hardcoded Microsoft SQL Server administrative password (CWE-798) that is shared across all installations. An attacker with network access to the database instance can authenticate as sysadmin, bypass application authentication, and run operating system commands as SYSTEM.
Written with Claude Haiku 5.5 from the sources below · 2026-10-28
Description from the CNA
Best Practice Software Bp Premier before 1.14.1.1128 uses a hardcoded Microsoft SQL Server administrative password that is shared across all installations and cannot be changed without breaking the application. Attackers with network access to the database instance can authenticate as sysadmin, bypass application authentication, and execute operating system commands as SYSTEM.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Best Practice Software | Bp Premier | before 1.14.1.1128 | 1.14.1.1128 | Patch available | CNA |
- Bp Premier VendorBest Practice Software Affected before 1.14.1.1128 Fixed in 1.14.1.1128 Patch available CNA
Remediation
Upgrade Best Practice Software Bp Premier to version 1.14.1.1128.
Written with Claude Haiku 5.5 from the sources below · 2026-10-28
- Fix · CNA Bp Premier (Best Practice Software) Fixed in 1.14.1.1128
Timeline
- 2026-10-21 Threatist record created from CVE-2026-114119
- 2026-10-28 CISA SSVC decision points changed
References
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences