Zero Radar
← feed
CriticalVulnerabilityCVE-2026-114119updated 25 Oct 2026, 18:51 UTC

Best Practice Bp Premier uses a shared hardcoded database admin password

The software has a built-in administrator password for its database that is the same on every installation. Anyone who can reach the database over the network may be able to take full control of the server.

Fixed in Version 1.14.1.1128 or laterOfficial, 2 sources
SeverityCriticalCVSS 9.3 of 10
Being exploited?UnclearNo reports either way yet
Fix available?YesVersion 1.14.1.1128 or later · since 25 Oct 2026
How sure is this?Official, 2 sourcesBacked by an official source

How the attack works simplified

  1. 1Network accessAttacker reaches the database port
  2. 2Shared passwordBuilt-in sysadmin password is the same everywhere
  3. 3Sysadmin loginAttacker authenticates as sysadmin
  4. 4Command executionOS commands run as SYSTEM
  5. ResultAttacker controls the server

What happened

Best Practice Software Bp Premier before 1.14.1.1128 contains a hardcoded Microsoft SQL Server sysadmin password shared across all installations, which cannot be changed without breaking the application.

Why it is dangerous: An attacker with network access to the database can log in as sysadmin, bypass application authentication, and run operating system commands as SYSTEM, giving full control of the host. Any organisation running an affected Bp Premier installation with a reachable database is at risk.

Are you affected?

You are affected if you run Best Practice Software Bp Premier older than 1.14.1.1128 with its Microsoft SQL Server database reachable over the network.

Best Practice Software Bp Premier, all versions before 1.14.1.1128

What to do

  1. Update Bp Premier to version 1.14.1.1128 or later
  2. Block network access to the Microsoft SQL Server database from anything other than the Bp Premier application servers
  3. Review the database for unexpected sysadmin accounts or logins and check the host for unexpected commands run as SYSTEM

Timeline

  1. 21 Oct 2026, 01:17 UTC
    Publicly disclosed
  2. 21 Oct 2026, 01:17 UTC
    Reported by NVD · NVD
  3. 25 Oct 2026, 18:50 UTC
    GitHub Advisory reported on it · GitHub Advisory
  4. 25 Oct 2026, 18:51 UTC
    Fix: Version 1.14.1.1128 or later

Sources 2 reports, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
CVE-2026-114119 · GHSA-hmqc-m6cv-3c9r
CVSS
9.3 / 10
EPSS
0.4% chance of exploitation within 30 days
Disclosed
21 Oct 2026, 01:17 UTC
On Zero Radar
before the radar started
Last change
25 Oct 2026, 18:51 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

Best Practice Bp Premier uses a shared hardcoded database admin password · Zero Radar