Bp Premier EUVD-2026-106922

The attacker needs network-level TCP connectivity to the bundled Microsoft SQL Server instance backing Bp Premier (default SQL Server port 1433) and knowledge of the static, installation-wide hardcoded sysadmin password - no application account, no valid user credentials, and no user interaction are required. OS command execution as SYSTEM presupposes the SQL Server service runs with SYSTEM privileges (the documented default) and that xp_cmdshell can be enabled by a sysadmin (possible by default for a sysadmin login). The primary limiting factor is database reachability: in correctly segmented clinic LANs the SQL instance is not internet-exposed, so exploitation is realistically constrained to attackers already on the internal network or deployments that expose port 1433; the credential cannot be changed without breaking the application, so no in-product hardening is possible pending the 1.14.1.1128 patch.

This is a genuine high-priority issue, not a CVSS-inflated paper risk. The vendor-assigned CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H, score 9.3) aligns cleanly with the description: a hardcoded Microsoft SQL Server sysadmin password (CWE-798) shared across all installations and unchangeable means exploitation requires no privileges, no user interaction, and low complexity - any attacker who can reach the SQL Server instance can authenticate as sysadmin and reach OS command execution as SYSTEM. Exploitation status: no public exploit identified at time of analysis (no KEV listing and no POC referenced in the provided intelligence), so this is a severe-but-not-yet-publicly-weaponized flaw. No EPSS score and no SSVC decision data were provided, so probabilistic exploitation likelihood cannot be quantified from this input. The single most important mitigating signal NOT captured by the network-vector metric is reachability: the CVSS AV:N assumes the SQL Server port is reachable by the attacker, but Bp Premier is a clinical practice system typically deployed on a LAN, so real-world risk is dominated by whether TCP 1433 is exposed beyond the local/clinic network - internet-exposed or flat-network deployments are critical, well-segmented ones are substantially lower. A patch is available from the vendor, which is the decisive remediation signal here.

An attacker with network reachability to the Bp Premier SQL Server instance (e.g., a malicious insider on the clinic LAN, or an external attacker where port 1433 is exposed) connects directly to the database and authenticates using the universal hardcoded sysadmin credential, bypassing the application entirely. With sysadmin rights they enable and invoke xp_cmdshell to run operating system commands as SYSTEM, achieving full host compromise and access to patient data. No public exploit code is referenced, but the attack is trivial to reproduce once the static password is known, given the low complexity and no authentication barrier.