Vulnerability · Published Oct 21, 2026 · Assigned by VulnCheck

CVE-2026-114119Best Practice Software Bp Premier before 1.14.1.1128 Hardcoded SQL Server Administrative Credential

Critical 9.8

In plain English

A critical-severity hard-coded credentials in Bp Premier from Best Practice Software. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 37% of all known vulnerabilities).

Severity (CVSS 3.1)9.8Critical

Exploit odds (30 days)0.4%top 62.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Best Practice Software Bp Premier before 1.14.1.1128 uses a hardcoded Microsoft SQL Server administrative password that is shared across all installations and cannot be changed without breaking the application. Attackers with network access to the database instance can authenticate as sysadmin, bypass application authentication, and execute operating system commands as SYSTEM.

Affected products (as reported)

Vendor	Product	Versions
Best Practice Software	Bp Premier	0 – before 1.14.1.1128

Weakness: CWE-798 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

Bp Premier Oxford SP1 Release Notes release-notes, patch
CI-ISAC Australia GCVE-123-2026-0001 third-party-advisory
VulnCheck Advisory: Best Practice Software Bp Premier before 1.14.1.1128 Hardcoded SQL Server Administrative Credential third-party-advisory