Bp Premier: One SQL Server sysadmin Password Shared by Every Installation — CVE-2026-114119 (9.8)

On October 21, 2026, NVD published CVE-2026-114119: Bp Premier, the medical practice management software from Best Practice Software, uses a hardcoded Microsoft SQL Server admin password that is the same on every installation and cannot be changed without breaking the application.

Anyone who knows that password and can reach a practice's SQL Server instance can log in as sysadmin, bypass the application's own authentication and run operating system commands as SYSTEM. For software that holds patient records, it is hard to think of a worse combination.

The vulnerability

Scores come from VulnCheck as CNA. NVD has marked the entry Deferred, with no CPE configuration. The CVE is not in the CISA KEV catalog at the time of writing.

Why it is this bad

Three properties stack up, all stated in the NVD description:

1. The password is shared across installations. Extract it once, from any single install, and it opens all the others.
2. It cannot be changed without breaking the application, so a practice's administrator has no configuration-level way out.
3. The account is sysadmin, SQL Server's top role. It reaches every database on the instance and allows OS command execution as SYSTEM.

The description does not say how commands get executed. On SQL Server, a sysadmin typically has xp_cmdshell or SQL Agent jobs at hand; that is the most likely route, but it is our assumption, not something NVD reports.

The only precondition is network access to the SQL Server instance. In a small practice, the database server often sits on the same network as the workstations, sometimes the same one as the Wi-Fi. One workstation compromised by a phishing email is then enough to reach the database.

What SYSTEM access means

An attacker running commands as SYSTEM on the database server does not just have the patient data; they own the machine. It is an ideal launch point for ransomware that encrypts the database along with any local backups. That is an inference, but it matches the pattern of attacks aimed at healthcare.

Affected versions

This bound comes from the NVD description. The references point to the vendor's Bp Premier Oxford SP1 release notes: check them for the upgrade procedure and any manual steps (such as rotating the SQL password) before you consider an installation fixed.

Detection

• Version: confirm which Bp Premier version runs on the server and on workstations.
• Network exposure: find out which machines can reach the SQL Server instance (TCP 1433 by default, or a dynamic port for a named instance).
• SQL Server logs: logins with the application account from machines that are not Bp Premier workstations; xp_cmdshell being enabled or used.
• Host: processes spawned by the SQL Server service (sqlservr.exe) such as cmd.exe or powershell.exe.

Mitigation

1. Upgrade to Bp Premier 1.14.1.1128 or later, following the vendor's release notes.
2. Lock down network access to the SQL Server instance with the server's Windows firewall, allowing only Bp Premier workstations. Since the password cannot be changed, this is the only effective control until the upgrade is done.
3. Separate the server and clinical workstations from guest Wi-Fi and personal devices.
4. Check your backups: keep at least one copy offline or outside the domain, out of reach of SYSTEM on the SQL server.
5. If you suspect compromise, handle it as a potential health data breach, with the notification duties that come with it.

Why continuous monitoring of line-of-business software matters

Practice management software never shows up in mainstream security bulletins, and this CVE was not analyzed by NIST. It only reaches you if your monitoring knows the product's name.

With cveo.tech, track your line-of-business software too, and get an alert as soon as a CVE names it, even without a CPE configuration.