Best Practice Software Bp Premier hardcoded SQL Server administrative password (CVE-2026-114119)

Best Practice Software Bp Premier versions before 1.14.1.1128 utilize a hardcoded Microsoft SQL Server administrative password. This credential is shared across all installations and is functionally required by the application, meaning it cannot be altered by administrators without causing operational failure. An attacker with network reach to the database instance can leverage this hardcoded credential to authenticate as a sysadmin. Once authenticated, the attacker can interact directly with the database engine to perform unauthorized queries, bypass application-level access controls, and use SQL Server stored procedures (such as xp_cmdshell) to execute operating system commands with SYSTEM privileges on the underlying host. This vulnerability represents a critical risk to health-sector environments where the software is deployed, as it grants full control over the database and host system.

Attack Chain

1. Attacker performs network reconnaissance to identify accessible Microsoft SQL Server instances on the network.
2. Attacker establishes a connection to the identified SQL Server instance using the hardcoded administrative credential.
3. Attacker authenticates to the database as an account with sysadmin-level privileges.
4. Attacker enables advanced configuration features within the SQL Server instance if not already active (e.g., sp_configure 'show advanced options', 1).
5. Attacker enables the xp_cmdshell stored procedure to facilitate command execution.
6. Attacker executes arbitrary system commands via xp_cmdshell to establish persistence or exfiltrate data.
7. Attacker gains full control over the host operating system with SYSTEM-level permissions.

Impact

Successful exploitation results in full compromise of the Bp Premier database and the host operating system. Given the nature of this software in medical environments, impact includes potential unauthorized access to sensitive patient health information, database destruction, and long-term persistence in the infrastructure of medical practices.

Recommendation

• Patch Bp Premier to version 1.14.1.1128 or later immediately to address the hardcoded credential issue.
• Restrict network access to Microsoft SQL Server instances used by Bp Premier to only authorized application servers using host-based firewalls or network segmentation.
• Audit SQL Server logs for unauthorized connection attempts or usage of system-level stored procedures.
• Disable the xp_cmdshell procedure at the database level if it is not explicitly required for application operation.