Best Practice Software Bp Premier: Hardcoded SQL Server administrative credential
Summary
Bp Premier uses a hardcoded Microsoft SQL Server administrative password that is shared across all installations and cannot be changed without breaking the application. An attacker with network access to the database instance can authenticate as sysadmin, bypass application authentication and run operating system commands, typically as SYSTEM. Exploitability depends on whether the SQL Server listener is reachable from untrusted networks.
Affected
- Bp Premier versions before 1.14.1.1128 (CVE description)
- CVE record lists 0 to less than 1.14.1.1128 as affected
Fixed in
- Oxford SP1 1.14.1.1129 is listed as unaffected in the CVE record and vendor release notes
- The CVE description names 1.14.1.1128 as the first fixed build; the vendor notes say 1.14.1.1128 users do not need 1.14.1.1129
- Upgrade to 1.14.1.1129 (or the latest build) to be safe
Workaround
- No vendor workaround removes the vulnerability.
- Restrict network access to the SQL Server listener so only the Bp Premier server can reach it.
- Do not expose the SQL Server listener to untrusted networks, remote access paths or the internet.
- Apply least privilege to the SQL Server service account where supported.
- Monitor for direct SQL Server logins and for enabling of OS command execution features.
Exploitation
- CISA SSVC: exploitation none, automatable yes, technical impact total.
- Not listed as known exploited in the sources checked.
- No public proof of concept found; this does not prove none exists.
Our recommendation
- Check whether any client runs Bp Premier and confirm the build version.
- Upgrade affected installations to the fixed Oxford SP1 build without delay.
- Restrict SQL Server network access to the Bp Premier server and approved workstations.
- Verify that the SQL Server port is not reachable from the internet.
- Monitor SQL Server logs for unusual sysadmin logins and command execution.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CI-ISAC CVE record (GCVE-123-2026-0001) def.ci-isac.org.au
- Bp Premier Oxford SP1 release notes kb.bestpracticesoftware.com
- VulnCheck advisory www.vulncheck.com
- OpenCVE CVE-2026-114119 app.opencve.io
- Strix CVE-2026-114119 www.strix.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 01:02.
Original description (NVD)
Best Practice Software Bp Premier before 1.14.1.1128 uses a hardcoded Microsoft SQL Server administrative password that is shared across all installations and cannot be changed without breaking the application. Attackers with network access to the database instance can authenticate as sysadmin, bypass application authentication, and execute operating system commands as SYSTEM.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.