Bp Premier (Australian GP clinical and practice software) shipped a hardcoded, shared SQL Server administrator password that gives network attackers sysadmin and SYSTEM command execution; CI-ISAC Australia rates it CVSS 9.6; fixed in Oxford SP1 (1.14.1.1129)

CI-ISAC Australia has published an advisory (GCVE-123-2026-0001, coordinated disclosure 25 September 2026) for Best Practice Software's Bp Premier, the clinical and practice-management system used by Australian general practices. Affected versions use a hardcoded Microsoft SQL Server administrative password that is the same on every installation and, in those versions, could not be changed without breaking the application. Anyone who can reach the practice's Bp Premier SQL Server instance over the network can log in with it, bypass the application's own authentication, gain sysadmin rights over the database (patient records included) and run operating-system commands, typically as SYSTEM. CI-ISAC rates it CVSS 3.1 9.6 (adjacent-network vector) and notes exploitability depends entirely on how exposed the database listener is. CI-ISAC lists Bp Premier 1.12.1.1023, 1.12.3.1042, 1.13.1.1080, 1.13.1.1096 and 1.14.0.1114 as affected and 1.14.1.1129 (Oxford SP1) as fixed. Best Practice Software's Oxford SP1 release notes (released 4 September 2026) describe a 'Security Update: Best Practice Database Connector' — a new Windows service that gives every practice a unique database access password stored within the practice environment — plus a Database Password Access Manager that controls which workstations may retrieve database credentials; the vendor says sites already on 1.14.1.1128 do not need 1.14.1.1129, and warns that medical devices such as ECG, spirometry and blood-pressure integrations may need reconnecting after the update. The flaw was reported to CI-ISAC by an anonymous researcher on 26 May 2026 and independently verified by CI-ISAC's Andrew Tunnecliffe in June. A CVE identifier, CVE-2026-114119, was added to the CVE list on 21 October 2026. No exploitation has been reported. Primary: CI-ISAC Australia advisory GCVE-123-2026-0001; vendor: Bp Premier Oxford SP1 release notes.

Product

Best Practice Software Bp Premier (general practice clinical and practice-management software, Microsoft SQL Server back end)

Versions

Affected (CI-ISAC): 1.12.1.1023, 1.12.3.1042, 1.13.1.1080, 1.13.1.1096, 1.14.0.1114 and other builds before Oxford SP1; fixed: Oxford SP1 1.14.1.1129 (1.14.1.1128 also SP1 per vendor)

CVSS

9.6 (CVSS 3.1, CI-ISAC Australia)

Exploited in Australia?

unknown

Patch to

Upgrade the Bp Premier server and every client to Oxford SP1 (1.14.1.1129) or later (requires the April 2026 Data Update or later; update the Reporting Tool, Bp Payments Utility and NCSR Utility first), then approve workstations in the Database Password Access Manager and re-test medical-device integrations. Until upgraded, and as defence in depth afterwards: make the SQL Server listener reachable only from the Bp Premier server and approved clinic workstations, never from the internet, VPN pools or remote-access paths; apply least privilege to the SQL Server service account; and alert on direct SQL Server logins and on xp_cmdshell or other OS-command features being enabled. Practices using an IT provider or hosted Bp Premier should confirm with them that the upgrade is done.

Primary: CI-ISAC Australia — GCVE-123-2026-0001: Bp Premier ships a hardcoded, shared SQL Server administrative credential (25 Sep 2026) · Vendor: Best Practice Software — Bp Premier Oxford SP1 release notes (1.14.1.1129; Database Connector security update) · CVE: CVE-2026-114119 · CVE.org — CVE-2026-114119 (added 21 Oct 2026)

vulnerabilities australia