{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/bp-premier--1.14.1.1128/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":9.8,"id":"CVE-2026-114119"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Bp Premier (\u003c 1.14.1.1128)","SQL Server (\u003c 1.14.1.1128)"],"_cs_severities":["critical"],"_cs_tags":["credential-exposure","rce","privilege-escalation"],"_cs_type":"advisory","_cs_vendors":["Best Practice Software","Microsoft"],"content_html":"\u003cp\u003eBest Practice Software Bp Premier versions before 1.14.1.1128 utilize a hardcoded Microsoft SQL Server administrative password. This credential is shared across all installations and is functionally required by the application, meaning it cannot be altered by administrators without causing operational failure. An attacker with network reach to the database instance can leverage this hardcoded credential to authenticate as a sysadmin. Once authenticated, the attacker can interact directly with the database engine to perform unauthorized queries, bypass application-level access controls, and use SQL Server stored procedures (such as xp_cmdshell) to execute operating system commands with SYSTEM privileges on the underlying host. This vulnerability represents a critical risk to health-sector environments where the software is deployed, as it grants full control over the database and host system.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker performs network reconnaissance to identify accessible Microsoft SQL Server instances on the network.\u003c/li\u003e\n\u003cli\u003eAttacker establishes a connection to the identified SQL Server instance using the hardcoded administrative credential.\u003c/li\u003e\n\u003cli\u003eAttacker authenticates to the database as an account with sysadmin-level privileges.\u003c/li\u003e\n\u003cli\u003eAttacker enables advanced configuration features within the SQL Server instance if not already active (e.g., sp_configure 'show advanced options', 1).\u003c/li\u003e\n\u003cli\u003eAttacker enables the xp_cmdshell stored procedure to facilitate command execution.\u003c/li\u003e\n\u003cli\u003eAttacker executes arbitrary system commands via xp_cmdshell to establish persistence or exfiltrate data.\u003c/li\u003e\n\u003cli\u003eAttacker gains full control over the host operating system with SYSTEM-level permissions.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation results in full compromise of the Bp Premier database and the host operating system. Given the nature of this software in medical environments, impact includes potential unauthorized access to sensitive patient health information, database destruction, and long-term persistence in the infrastructure of medical practices.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003ePatch Bp Premier to version 1.14.1.1128 or later immediately to address the hardcoded credential issue.\u003c/li\u003e\n\u003cli\u003eRestrict network access to Microsoft SQL Server instances used by Bp Premier to only authorized application servers using host-based firewalls or network segmentation.\u003c/li\u003e\n\u003cli\u003eAudit SQL Server logs for unauthorized connection attempts or usage of system-level stored procedures.\u003c/li\u003e\n\u003cli\u003eDisable the xp_cmdshell procedure at the database level if it is not explicitly required for application operation.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-21T02:15:22Z","date_published":"2026-10-21T02:15:22Z","id":"https://feed.craftedsignal.io/briefs/2026-10-bp-premier-hardcoded-creds/","summary":"Best Practice Software Bp Premier versions prior to 1.14.1.1128 contain a hardcoded Microsoft SQL Server administrative password that allows remote unauthenticated attackers to execute operating system commands as SYSTEM.","title":"Best Practice Software Bp Premier hardcoded SQL Server administrative password (CVE-2026-114119)","url":"https://feed.craftedsignal.io/briefs/2026-10-bp-premier-hardcoded-creds/"}],"language":"en","title":"CraftedSignal Threat Feed - Bp Premier (\u003c 1.14.1.1128)","version":"https://jsonfeed.org/version/1.1"}