CVE-2026-114119 — Bp Premier (60% of Australian GP clinics) ships the same SQL Server sysadmin password across every installation. It cannot be changed without breaking the app.
Reach TCP 1433 → authenticate as sysadmin → bypass app login → xp_cmdshell as SYSTEM → patient records, Medicare data, prescribing history.
No PoC needed. The credential is in the installer.
Fix: Oxford SP1 1.14.1.1128 / 1.14.1.1129. Verify the Database Connector service is running after upgrade. Block 1433 from untrusted networks now.
Two records disagree on AV:N vs AV:A. Don't assume the safer one.
https://threataft.com/articles/bp-premier-cve-2026-114119-hardcoded-sql-server-password
ThreatAftBp Premier: One SQL Password for Every Clinic | ThreatAftCVE-2026-114119: Bp Premier ships one SQL Server sysadmin password for every clinic. 60% of Australian GP practices. Fixed in 1.14.1.1128/1129.