CVE-2026-114119: Bp Premier ships an unchangeable SQL Server admin password

Bp Premier before 1.14.1.1128 uses a hardcoded Microsoft SQL Server admin password shared across all installations and not changeable without breaking the app. Anyone with network access to the database port can log in as sysadmin and run OS commands as SYSTEM.

• Affects every Bp Premier install before 1.14.1.1128
• The credential is identical everywhere and cannot be rotated by customers
• Sysadmin rights allow OS command execution as SYSTEM
• Fixed build is 1.14.1.1128, present in the Oxford SP1 train