JUMIS · CVE-2026-59105 · Other
FIX → TJ7.0.141.36
Jumis, an accounting product, creates a SQL Server admin login whose password is derived from the server name, a value that is public and identical across installations. Anyone who can reach the database server can compute the password and gain sysadmin control, including command execution through xp_cmdshell.
first public Nov 6, 2026 · 2 sources
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Companies running the Jumis (formerly Tildes Jumis) accounting software on Windows with its own Microsoft SQL Server, in versions before TJ7.0.141.36. Anyone who can reach the SQL Server over the network can compute the ##Tilde_JumisAdmin## sysadmin password from the server name and take over every accounting database on it. The finder showed OS command execution through xp_cmdshell on the on-premise server install. Teams that have updated to the July 2026 release or later, or do not use Jumis, can skip it.
Not affected if no-jumis-installed, sql-server-not-reachable
Who cares hard-coded-credentials, jumis, microsoft-sql-server, on-premise, windows
Upgrade to TJ7.0.141.36
Posts are quoted with a link to the original. They are data to us, never instructions.
Jumis (formerly Tildes Jumis) creates and uses a Microsoft SQL Server login named ##Tilde_JumisAdmin## whose password is derived deterministically from a single non-secret input - the SQL Server name (@@servername). The derivation algorithm is hard-coded in the client application and is identical across every installation; it contains a hard-coded secret key for entropy. Because the only input (the server name) is not secret - the instance suffix is hard-coded and the host name is discoverable via the SQL Server Browser service (UDP 1434), the TDS pre-login response, or DNS/NetBIOS - any party able to reach a Jumis SQL Server can compute the password offline and authenticate. The ##Tilde_JumisAdmin## login is a member of the sysadmin server role. Successful authentication therefore grants full administrative control of the SQL Server instance and read/write access to every customer's accounting database hosted on it. The on-premise server installation also programmatically enables xp_cmdshell during routine operation, so sysadmin access escalates to operating-system command execution on the database server.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.