Search
Find a vulnerability
Search criteria
ⓘ
Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.
3 vulnerabilities by Best Practice Software
CVE-2026-114119 (GCVE-0-2026-114119)
Vulnerability from nvd – Published: 2026-10-21 00:37 – Updated: 2026-10-28 16:19
VLAI
EPSS
VEX
Title
Best Practice Software Bp Premier before 1.14.1.1128 Hardcoded SQL Server Administrative Credential
Summary
Best Practice Software Bp Premier before 1.14.1.1128 uses a hardcoded Microsoft SQL Server administrative password that is shared across all installations and cannot be changed without breaking the application. Attackers with network access to the database instance can authenticate as sysadmin, bypass application authentication, and execute operating system commands as SYSTEM.
Severity
9.8 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-28 16:18 UTC
CWE
- CWE-798 - Use of Hard-coded Credentials
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://kb.bestpracticesoftware.com/bppremier/oxf… | release-notespatch |
| https://def.ci-isac.org.au/vuln/records/GCVE-123-… | third-party-advisory |
| https://www.vulncheck.com/advisories/best-practic… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Best Practice Software | Bp Premier |
Affected:
0 , < 1.14.1.1128
(custom)
Unaffected: 1.14.1.1128 (custom) |
Date Public
2026-09-25 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-114119",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-28T16:18:29.296439Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-28T16:19:31.357Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Bp Premier",
"vendor": "Best Practice Software",
"versions": [
{
"lessThan": "1.14.1.1128",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "1.14.1.1128",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Andrew Tunnecliffe (CI-ISAC Australia)"
},
{
"lang": "en",
"type": "coordinator",
"value": "CI-ISAC Australia"
}
],
"datePublic": "2026-09-25T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Best Practice Software Bp Premier before 1.14.1.1128 uses a hardcoded Microsoft SQL Server administrative password that is shared across all installations and cannot be changed without breaking the application. Attackers with network access to the database instance can authenticate as sysadmin, bypass application authentication, and execute operating system commands as SYSTEM."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-798",
"description": "Use of Hard-coded Credentials",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T00:37:16.230Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "Bp Premier Oxford SP1 Release Notes",
"tags": [
"release-notes",
"patch"
],
"url": "https://kb.bestpracticesoftware.com/bppremier/oxford/WhatsNew/BpPremier_OxfordSP1_ReleaseNotes.htm"
},
{
"name": "CI-ISAC Australia GCVE-123-2026-0001",
"tags": [
"third-party-advisory"
],
"url": "https://def.ci-isac.org.au/vuln/records/GCVE-123-2026-0001.json"
},
{
"name": "VulnCheck Advisory: Best Practice Software Bp Premier before 1.14.1.1128 Hardcoded SQL Server Administrative Credential",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/best-practice-software-bp-premier-before-1.14.1.1128-hardcoded-sql-server-administrative-credential"
}
],
"title": "Best Practice Software Bp Premier before 1.14.1.1128 Hardcoded SQL Server Administrative Credential",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-114119",
"datePublished": "2026-10-21T00:37:16.230Z",
"dateReserved": "2026-10-20T21:48:58.503Z",
"dateUpdated": "2026-10-28T16:19:31.357Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-114119 (GCVE-0-2026-114119)
Vulnerability from cvelistv5 – Published: 2026-10-21 00:37 – Updated: 2026-10-28 16:19
VLAI
EPSS
VEX
Title
Best Practice Software Bp Premier before 1.14.1.1128 Hardcoded SQL Server Administrative Credential
Summary
Best Practice Software Bp Premier before 1.14.1.1128 uses a hardcoded Microsoft SQL Server administrative password that is shared across all installations and cannot be changed without breaking the application. Attackers with network access to the database instance can authenticate as sysadmin, bypass application authentication, and execute operating system commands as SYSTEM.
Severity
9.8 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-28 16:18 UTC
CWE
- CWE-798 - Use of Hard-coded Credentials
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://kb.bestpracticesoftware.com/bppremier/oxf… | release-notespatch |
| https://def.ci-isac.org.au/vuln/records/GCVE-123-… | third-party-advisory |
| https://www.vulncheck.com/advisories/best-practic… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Best Practice Software | Bp Premier |
Affected:
0 , < 1.14.1.1128
(custom)
Unaffected: 1.14.1.1128 (custom) |
Date Public
2026-09-25 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-114119",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-28T16:18:29.296439Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-28T16:19:31.357Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Bp Premier",
"vendor": "Best Practice Software",
"versions": [
{
"lessThan": "1.14.1.1128",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "1.14.1.1128",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Andrew Tunnecliffe (CI-ISAC Australia)"
},
{
"lang": "en",
"type": "coordinator",
"value": "CI-ISAC Australia"
}
],
"datePublic": "2026-09-25T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Best Practice Software Bp Premier before 1.14.1.1128 uses a hardcoded Microsoft SQL Server administrative password that is shared across all installations and cannot be changed without breaking the application. Attackers with network access to the database instance can authenticate as sysadmin, bypass application authentication, and execute operating system commands as SYSTEM."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-798",
"description": "Use of Hard-coded Credentials",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T00:37:16.230Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "Bp Premier Oxford SP1 Release Notes",
"tags": [
"release-notes",
"patch"
],
"url": "https://kb.bestpracticesoftware.com/bppremier/oxford/WhatsNew/BpPremier_OxfordSP1_ReleaseNotes.htm"
},
{
"name": "CI-ISAC Australia GCVE-123-2026-0001",
"tags": [
"third-party-advisory"
],
"url": "https://def.ci-isac.org.au/vuln/records/GCVE-123-2026-0001.json"
},
{
"name": "VulnCheck Advisory: Best Practice Software Bp Premier before 1.14.1.1128 Hardcoded SQL Server Administrative Credential",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/best-practice-software-bp-premier-before-1.14.1.1128-hardcoded-sql-server-administrative-credential"
}
],
"title": "Best Practice Software Bp Premier before 1.14.1.1128 Hardcoded SQL Server Administrative Credential",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-114119",
"datePublished": "2026-10-21T00:37:16.230Z",
"dateReserved": "2026-10-20T21:48:58.503Z",
"dateUpdated": "2026-10-28T16:19:31.357Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
GCVE-123-2026-0001
Vulnerability from gna-123 – Published: 2026-09-25 00:00 – Updated: 2026-09-25 07:35
VLAI
EPSS
VEX
Title
Best Practice Software Bp Premier ships a hardcoded, shared SQL Server administrative credential
Summary
Best Practice Software Bp Premier uses a hardcoded Microsoft SQL Server administrative password that is shared across all installations; in affected versions, the credential could not be changed without breaking the application. An attacker with network access to the database instance can use this credential to bypass application authentication and gain sysadmin privileges, allowing for arbitrary operating-system command execution (typically as SYSTEM). Exploitability depends entirely on the database's network exposure.
Severity
9.6 (Critical)
CWE
Assigner
References
2 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Best Practice Software | Bp Premier |
Affected:
1.12.1.1023
Affected: 1.12.3.1042 Affected: 1.13.1.1080 Affected: 1.13.1.1096 Affected: 1.14.0.1114 Unaffected: 1.14.1.1129 , < * (custom) cpe:2.3:a:best_practice_software:bp_premier:*:*:*:*:*:*:*:* |
{
"containers": {
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:best_practice_software:bp_premier:*:*:*:*:*:*:*:*"
],
"defaultStatus": "affected",
"product": "Bp Premier",
"vendor": "Best Practice Software",
"versions": [
{
"status": "affected",
"version": "1.12.1.1023"
},
{
"status": "affected",
"version": "1.12.3.1042"
},
{
"status": "affected",
"version": "1.13.1.1080"
},
{
"status": "affected",
"version": "1.13.1.1096"
},
{
"status": "affected",
"version": "1.14.0.1114"
},
{
"lessThan": "*",
"status": "unaffected",
"version": "1.14.1.1129",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Independent researcher who elected to remain unnamed."
},
{
"lang": "en",
"type": "finder",
"value": "Andrew Tunnecliffe (CI-ISAC Australia)."
},
{
"lang": "en",
"type": "coordinator",
"value": "CI-ISAC Australia, National Intelligence Office."
}
],
"descriptions": [
{
"lang": "en",
"value": "Best Practice Software Bp Premier uses a hardcoded Microsoft SQL Server administrative password that is shared across all installations; in affected versions, the credential could not be changed without breaking the application. An attacker with network access to the database instance can use this credential to bypass application authentication and gain sysadmin privileges, allowing for arbitrary operating-system command execution (typically as SYSTEM). Exploitability depends entirely on the database\u0027s network exposure."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.6,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-798",
"description": "CWE-798 Use of Hard-coded Credentials",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-522",
"description": "CWE-522 Insufficiently Protected Credentials",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-269",
"description": "CWE-269 Improper Privilege Management",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"orgId": "b2ca432d-cded-42d0-8f57-c6a1a430c957",
"shortName": "CI-ISAC"
},
"references": [
{
"name": "CI-ISAC Australia Vulnerability Disclosure Policy",
"url": "https://ci-isac.org.au/vulnerability-disclosure-policy"
},
{
"name": "Vendor release notes (Oxford SP1)",
"tags": [
"release-notes"
],
"url": "https://kb.bestpracticesoftware.com/bppremier/oxford/WhatsNew/BpPremier_OxfordSP1_ReleaseNotes.htm"
}
],
"solutions": [
{
"lang": "en",
"value": "Upgrade to Bp Premier 1.14.1.1129 (Oxford SP1) or later."
}
],
"timeline": [
{
"lang": "en",
"time": "2026-05-26T00:00:00.000Z",
"value": "Reported to CI-ISAC Australia by anonymous third party."
},
{
"lang": "en",
"time": "2026-06-03T00:00:00.000Z",
"value": "Independently verified by CI-ISAC Australia; additional detail established."
},
{
"lang": "en",
"time": "2026-09-25T00:00:00.000Z",
"value": "Coordinated public disclosure."
}
],
"title": "Best Practice Software Bp Premier ships a hardcoded, shared SQL Server administrative credential",
"workarounds": [
{
"lang": "en",
"value": "The following reduce reachability and blast radius but do not remove the vulnerability. Restrict network access to the Bp Premier SQL Server listener so it is reachable only from the Bp Premier server; do not expose the SQL Server listener to untrusted networks, remote-access paths, or the public internet; apply least privilege to the SQL Server service account where the deployment supports it; and monitor for anomalous direct SQL Server authentication and for enabling of operating-system command execution features."
}
],
"x_gcve": [
{
"recordType": "advisory",
"vulnId": "GCVE-123-2026-0001"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "b2ca432d-cded-42d0-8f57-c6a1a430c957",
"assignerShortName": "CI-ISAC",
"datePublished": "2026-09-25T00:00:00.000Z",
"dateReserved": "2026-06-11T00:00:00.000Z",
"dateUpdated": "2026-09-25T07:35:42.672Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2.0"
}