Best Practice Software Bp Premier releases before 1.14.1.1128 contain a hardcoded Microsoft SQL Server administrative password that is identical across all installations. The password is immutable without breaking the application, giving attackers with network access to the database instant sysadmin rights, allowing them to bypass the application’s authentication mechanisms and run arbitrary operating system commands with SYSTEM privileges.

The affected product is Best Practice Software Bp Premier. All installations of versions prior to 1.14.1.1128 are vulnerable because the hardcoded credential is present in every build before that release. The vulnerability impacts any deployment where the bundled SQL Server instance is exposed to a network that the attacker can reach.

The vulnerability scores a CVSS of 9.3, indicating critical severity. The EPSS is reported as less than 1 %, implying a low current exploitation probability, and the issue is not listed in the CISA KEV catalog. Attackers can exploit the flaw by connecting to the SQL Server over the network, authenticating with the embedded admin account, and issuing privileged commands. Based on the description, it is inferred that the attacker merely needs network connectivity to the SQL Server instance, no elevated credentials beyond that, to achieve full system compromise.