CVE-2026-114119: Use of Hard-coded Credentials in Best Practice Software Bp Premier

CVE-2026-114119 describes a critical vulnerability in Best Practice Software Bp Premier prior to version 1.14.1.1128. The software uses a hardcoded Microsoft SQL Server administrative password that is identical across all installations and immutable without causing application failure. This flaw allows an attacker with network access to the database instance to authenticate with sysadmin privileges, bypass the application's authentication mechanisms, and execute arbitrary operating system commands with SYSTEM-level privileges.

Successful exploitation grants an attacker full administrative access to the Microsoft SQL Server instance used by Bp Premier, bypassing application-level authentication controls. This includes the ability to execute arbitrary operating system commands as the SYSTEM user, which can lead to complete system compromise. The vulnerability is rated critical with a CVSS 4.0 score of 9.3, reflecting its high impact and ease of exploitation over the network without authentication.

No official patch or remediation information is provided in the input data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict network access to the database instance to trusted administrators only and monitor for unauthorized access attempts. Avoid exposing the database server to untrusted networks.