CVE-2026-114119

CriticalCVSS 9.8/10Last modified Oct 22, 2026

Description

Best Practice Software Bp Premier before 1.14.1.1128 uses a hardcoded Microsoft SQL Server administrative password that is shared across all installations and cannot be changed without breaking the application. Attackers with network access to the database instance can authenticate as sysadmin, bypass application authentication, and execute operating system commands as SYSTEM.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-798

Affected software

No affected versions have been published.

Timeline

Published: Oct 21, 2026
Last modified: Oct 22, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-114126.3A weakness has been identified in Jinher OA C6. The affected element is an unknown function of the file /C6/JHSoft.Web.ModuleCount/GetFormSn CVE-2026-1141205.4SchedulePress before 5.3.5 contains a missing authorization vulnerability that allows authenticated Contributor-level users to change any po CVE-2026-1141215.4Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 42.11.3, 43.7.0, 4 CVE-2026-1141223.9Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 42.11.6, 43.7.3, 4 CVE-2026-1141237.5D365 F&O MCP Server is a Model Context Protocol server for querying Dynamics 365 Finance & Operations X++ code and metadata. Prior to versio CVE-2026-1141243.9Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 42.11.6, 43.7.3, 4 CVE-2026-1141258.6Storybook is a frontend workshop for building user interface components and pages in isolation. From 8.0.0 until 8.6.19, 9.1.21, 10.6.2, and CVE-2026-1141268.7Storybook is a frontend workshop for building user interface components and pages in isolation. From 8.0.0 until 8.6.19, 9.1.21, 10.6.2, and CVE-2026-1141272.3Astro is a web framework for content-driven websites. From 7.1.0 until 7.3.3, Astro's server-side View Transition CSS generator does not kee CVE-2026-1141286.5Astro is a web framework for content-driven websites. Prior to 7.3.2, Astro's JSX and MDX rendering pipeline treats string children of scrip CVE-2026-1141296.2stream-json is a micro-library of stream components for processing JSON and JSONC with a minimal memory footprint. From 2.0.0 until 3.7.0, F CVE-2026-114138.8A security vulnerability has been detected in JingDong JD Cloud Box AX6600 4.5.3.r4546. The impacted element is the function set_macfilter o