CVE-2026-114119: Hardcoded MSSQL Sysadmin Password in Bp Premier — Detection and Remediation Guide for Healthcare Defenders

---
title: MSSQL Server Spawning Command Shell via xp_cmdshell
id: 3c9f2a71-5b48-4e6d-9a13-7f2c8d1e4b56
status: experimental
description: Detects sqlservr.exe spawning cmd.exe or powershell.exe, indicative of xp_cmdshell abuse following sysadmin authentication such as exploitation of CVE-2026-114119 hardcoded credentials in Bp Premier.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-114119
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.execution
  - attack.t1059.003
  - attack.t1190
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith: '\sqlservr.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\rundll32.exe'
      - '\regsvr32.exe'
      - '\mshta.exe'
      - '\net.exe'
      - '\net1.exe'
      - '\whoami.exe'
      - '\certutil.exe'
      - '\bitsadmin.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Rare legitimate SQL Server maintenance jobs invoking command shells; validate against approved job schedules
level: critical
---
title: SQL Server Configuration Change Enabling xp_cmdshell
id: 8d4e6b02-1a37-4c59-bf28-9e3d5a7c1f64
status: experimental
description: Detects process or script activity referencing sp_configure changes to xp_cmdshell or the creation of new SQL logins, a hallmark of post-authentication activity against MSSQL instances including CVE-2026-114119 exploitation.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-114119
  - https://attack.mitre.org/techniques/T1078/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.persistence
  - attack.t1078
  - attack.t1505
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine|contains:
      - 'xp_cmdshell'
      - 'sp_configure'
      - 'sp_addlogin'
      - 'sp_addsrvrolemember'
      - 'CREATE LOGIN'
      - 'sysadmin'
  filter_tools:
    Image|endswith:
      - '\ssms.exe'
      - '\sqlservr.exe'
  condition: selection and not filter_tools
falsepositives:
  - DBAs running sqlcmd/osql for legitimate administration; baseline authorized admin workstations and service accounts
level: high
---
title: Network Connection to MSSQL From Non-Database Server Host
id: 5f1a9c34-6d82-4b7e-8c41-2b6e9f3a7d18
status: experimental
description: Detects inbound connections to TCP 1433 on hosts running sqlservr.exe from sources outside expected application server patterns. Pivot in your environment to alert only when the source is not the known Bp Premier application tier.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-114119
  - https://attack.mitre.org/techniques/T1021/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.lateral_movement
  - attack.t1021
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    Image|endswith: '\sqlservr.exe'
    DestinationPort: 1433
    Initiated: 'false'
  condition: selection
falsepositives:
  - Legitimate Bp Premier application server connections; tune by whitelisting the known application-tier IP addresses before production deployment
level: medium

// Hunt: sqlservr.exe spawning command interpreters (xp_cmdshell behavior) — CVE-2026-114119
// Scope to your Bp Premier database servers for the highest signal-to-noise ratio.
let lookback = 14d;
let sqlServers =
    DeviceProcessEvents
    | where TimeGenerated > ago(30d)
    | where FileName =~ "sqlservr.exe"
    | summarize by DeviceName;
DeviceProcessEvents
| where TimeGenerated > ago(lookback)
| where InitiatingProcessFileName =~ "sqlservr.exe"
| where DeviceName in (sqlServers)
| where FileName in~ ("cmd.exe","powershell.exe","pwsh.exe","net.exe","whoami.exe","certutil.exe","bitsadmin.exe","rundll32.exe","regsvr32.exe","mshta.exe","wscript.exe","cscript.exe")
| project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessCommandLine, SHA256
| order by TimeGenerated desc;

// Hunt: Network connections to MSSQL (1433) from unexpected hosts on Bp Premier DB servers
// Requires Defender for Endpoint or equivalent network telemetry. Whitelist the application tier.
let appTierIPs = dynamic(["10.0.0.0/8_placeholder_replace_with_app_server_IPs"]);
DeviceNetworkEvents
| where TimeGenerated > ago(7d)
| where LocalPort == 1433
| where InitiatingProcessFileName =~ "sqlservr.exe" or LocalPort == 1433
| extend RemoteIPType = iff(ipv4_is_private(RemoteIP), "private", "public")
| summarize Connections = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated)
    by DeviceName, RemoteIP, RemoteIPType, InitiatingProcessFileName
| order by Connections desc;

-- Velociraptor artifact: enumerate MSSQL processes, their children, and 1433 listeners
-- Deploy as a hunt scoped to Windows hosts in the clinical/server VLAN.
SELECT Pid, Ppid, Name, Exe, CommandLine, Username, CreateTime
FROM pslist()
WHERE Name =~ '(?i)sqlservr'
   OR Exe =~ '(?i)sqlservr'

-- Second query in the same artifact: find children of sqlservr.exe (xp_cmdshell evidence)
LET sql_pids = SELECT Pid FROM pslist() WHERE Name =~ '(?i)sqlservr'
SELECT Pid, Ppid, Name, Exe, CommandLine, Username, CreateTime
FROM pslist()
WHERE Ppid in (SELECT Pid FROM sql_pids)

-- Third query: who is listening on and connected to 1433
SELECT Pid, Name, LocalAddr, LocalPort, RemoteAddr, RemotePort, State
FROM netstat()
WHERE LocalPort = 1433 OR RemotePort = 1433

# CVE-2026-114119 verification and interim hardening — run on the Bp Premier SQL Server host
# 1) Check installed Bp Premier version (adjust path if installed elsewhere)
$bpPaths = @("C:\Program Files\Best Practice Software", "C:\Program Files (x86)\Best Practice Software")
foreach ($p in $bpPaths) {
    if (Test-Path $p) {
        Get-ChildItem $p -Recurse -Filter *.exe -ErrorAction SilentlyContinue |
            Select-Object FullName, @{N='Version';E={$_.VersionInfo.ProductVersion}} |
            Sort-Object Version -Descending | Select-Object -First 5
    }
}

# 2) Check whether xp_cmdshell is currently enabled on the local instance (requires sqlcmd)
#    A value of 1 on a system where you never enabled it is a serious red flag.
sqlcmd -S localhost -Q "SELECT name, value_in_use FROM sys.configurations WHERE name IN ('xp_cmdshell','Ad Hoc Distributed Queries','clr enabled');" -W

# 3) Review recent failed and successful SQL logins if SQL Server login auditing is enabled
Get-WinEvent -FilterHashtable @{LogName='Application'; Id=18453,18454,18456} -MaxEvents 50 -ErrorAction SilentlyContinue |
    Select-Object TimeCreated, Id, Message | Format-List

# 4) Interim network-layer mitigation: restrict 1433 to the Bp Premier application server ONLY
#    Replace 10.10.20.15 with your actual application-tier IP before running.
$appServerIP = "10.10.20.15"
New-NetFirewallRule -DisplayName "MSSQL 1433 - Bp Premier App Tier Only (CVE-2026-114119)" `
    -Direction Inbound -Protocol TCP -LocalPort 1433 -RemoteAddress $appServerIP -Action Allow
New-NetFirewallRule -DisplayName "MSSQL 1433 - Block All Other Sources (CVE-2026-114119)" `
    -Direction Inbound -Protocol TCP -LocalPort 1433 -Action Block

# 5) Confirm SQL Server service account — if it runs as SYSTEM or a domain admin, that is your
#    post-exploitation blast radius. Downgrade to a gMSA or least-privilege account per vendor guidance.
Get-CimInstance Win32_Service -Filter "Name LIKE 'MSSQL%'" |
    Select-Object Name, StartName, State