{"id":"CVE-2026-59105","kind":"vulnerability","aliases":["CVE-2026-59105"],"related":[],"title":"Jumis accounting: hard-coded SQL Server admin password lets anyone take over","description":"Jumis (formerly Tildes Jumis) creates and uses a Microsoft SQL Server login named ##Tilde_JumisAdmin## whose password is derived deterministically from a single non-secret input - the SQL Server name (@@servername). The derivation algorithm is hard-coded in the client application and is identical across every installation; it contains a hard-coded secret key for entropy. Because the only input (the server name) is not secret - the instance suffix is hard-coded and the host name is discoverable via the SQL Server Browser service (UDP 1434), the TDS pre-login response, or DNS/NetBIOS - any party able to reach a Jumis SQL Server can compute the password offline and authenticate. The ##Tilde_JumisAdmin## login is a member of the sysadmin server role. Successful authentication therefore grants full administrative control of the SQL Server instance and read/write access to every customer's accounting database hosted on it. The on-premise server installation also programmatically enables xp_cmdshell during routine operation, so sysadmin access escalates to operating-system command execution on the database server.","summary":"Jumis, an accounting product, creates a SQL Server admin login whose password is derived from the server name, a value that is public and identical across installations. Anyone who can reach the database server can compute the password and gain sysadmin control, including command execution through xp_cmdshell.","severity":"critical","cvss":9.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Jumis","fixed":["TJ7.0.141.36"],"affected":"< TJ7.0.141.36","ecosystem":"vendor"}],"ecosystems":[],"tags":["hard-coded-credentials","jumis","microsoft-sql-server","on-premise","other","windows"],"not_affected_if":["no-jumis-installed","sql-server-not-reachable"],"how_to_check":"- Check the Jumis version: anything older than TJ7.0.141.36 is affected (July 2026 release; the finder tested 7.0.140).\n- In SQL Server Management Studio, look under Security > Logins for ##Tilde_JumisAdmin## on the instance, or run: SELECT name FROM sys.server_principals WHERE name = '##Tilde_JumisAdmin##'\n- Check whether the login is in the sysadmin role and whether xp_cmdshell is enabled (sp_configure 'xp_cmdshell').\n- After updating, the finder says the login should hold only a limited public account in legacy databases and none in new ones.\n- Check that UDP 1434 and the SQL port are not reachable from untrusted networks.","fix":"Update Jumis to release TJ7.0.141.36 (July 2026 release) or later; latest per OffSeq is TJ7.0.142.7. Until updated, restrict network access to the SQL Server to hosts that need it.","status":"open","published_at":"2026-11-06T15:17:22+00:00","first_seen_at":"2026-11-06T15:42:45+00:00","triaged_at":"2026-11-06T15:43:58+00:00","updated_at":"2026-11-06T15:45:22+00:00","category":"other","confidence":0.8,"triage":{"at":"2026-11-06T15:43:58Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Jumis accounting: hard-coded SQL Server admin password lets anyone take over","impact":"high","summary":"Jumis, an accounting product, creates a SQL Server admin login whose password is derived from the server name, a value that is public and identical across installations. Anyone who can reach the database server can compute the password and gain sysadmin control, including command execution through xp_cmdshell.","audience":"businesses","category":"other","nicknames":[],"who_cares":["jumis","microsoft-sql-server","on-premise","windows"],"confidence":0.7,"fix_status":"unknown","needs_auth":"no","worst_case":"attacker gets sysadmin on SQL Server and OS command execution","analyst_note":"Find the vendor advisory and the affected and fixed Jumis versions; the NVD entry alone gives no product ranges or fix.","how_to_check":"- Look for a SQL Server login named `##Tilde_JumisAdmin##` in the instance's logins list\n- Check whether the Jumis on-premise server installation is present on the database host\n- Check whether `xp_cmdshell` is enabled on the instance","plain_action":"","needs_analyst":true,"not_affected_if":["sql-server-not-reachable","no-jumis-installed"],"who_is_affected":"Companies that run an on-premise Jumis server with Microsoft SQL Server, where the database port can be reached from a network the attacker can use. Installations where SQL Server is not reachable from untrusted networks have a smaller exposure, but the sources do not state a version range or fix, so the affected set is not fully known.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"critical"},"cost_usd":0.000744,"input_tokens":4500,"output_tokens":588,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Find the vendor advisory and the affected and fixed Jumis versions; the NVD entry alone gives no product ranges or fix.","search":"'-2026':14A,17A '-59105':15A,18A '1434':171C 'abl':182C 'access':222C,248C 'account':2A,36B,227C 'across':59B,128C 'admin':8A,42B 'administr':213C 'algorithm':116C 'also':238C 'anyon':11A,61B 'applic':124C 'authent':195C,209C 'browser':168C 'client':123C 'cmdshell':81B,242C 'code':5A,22B,120C,136C,157C 'command':77B,254C 'comput':69B,190C 'contain':132C 'control':75B,214C 'creat':38B,86C 'credenti':23B 'custom':225C 'cve':13A,16A 'databas':66B,228C,258C 'deriv':47B,100C,115C 'determinist':101C 'discover':163C 'dns/netbios':179C 'enabl':240C 'entropi':140C 'escal':249C 'everi':129C,224C 'execut':78B,255C 'former':83C 'full':212C 'gain':73B 'grant':211C 'hard':4A,21B,119C,135C,156C 'hard-cod':3A,118C,134C,155C 'hard-coded-credenti':20B 'host':160C,229C 'ident':58B,127C 'includ':76B 'input':108C,144C 'instal':60B,130C,237C 'instanc':152C,219C 'jumi':1A,24B,34B,82C,85C,186C 'jumis':19A 'jumisadmin':96C,198C 'key':138C 'let':10A 'login':43B,93C,176C,199C 'member':202C 'microsoft':26B,90C 'microsoft-sql-serv':25B 'name':51B,94C,112C,147C,161C 'non':106C 'non-secret':105C 'offlin':193C 'on-premis':29B,233C 'oper':245C,252C 'operating-system':251C 'parti':181C 'password':9A,45B,71B,98C,192C 'pre':175C 'pre-login':174C 'premis':31B,235C 'product':37B 'programmat':239C 'public':56B 'reach':64B,184C 'read/write':221C 'respons':177C 'role':207C 'routin':244C 'secret':107C,137C,150C 'server':7A,28B,41B,50B,67B,92C,111C,146C,167C,188C,206C,218C,236C,259C 'servernam':113C 'servic':169C 'singl':104C 'sql':6A,27B,40B,91C,110C,166C,187C,217C 'success':208C 'suffix':153C 'sysadmin':74B,205C,247C 'system':253C 'take':12A 'tds':173C 'therefor':210C 'tild':84C,95C,197C 'udp':170C 'use':88C 'valu':53B 'via':164C 'whose':44B,97C 'window':33B 'xp':80B,241C","nicknames":[],"mitigations":[],"who_affected":"Companies running the Jumis (formerly Tildes Jumis) accounting software on Windows with its own Microsoft SQL Server, in versions before TJ7.0.141.36. Anyone who can reach the SQL Server over the network can compute the ##Tilde_JumisAdmin## sysadmin password from the server name and take over every accounting database on it. The finder showed OS command execution through xp_cmdshell on the on-premise server install. Teams that have updated to the July 2026 release or later, or do not use Jumis, can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["jumis"],"ptokens":["jumis"],"labels":["critical","hardcodedcredentials","jumis","microsoftsqlserver","onpremise","other","windows"],"campaign_type":null,"search_a":"'-2026':14A,17A '-59105':15A,18A 'account':2A 'admin':8A 'anyon':11A 'code':5A 'cve':13A,16A 'hard':4A 'hard-cod':3A 'jumi':1A 'jumis':19A 'let':10A 'password':9A 'server':7A 'sql':6A 'take':12A","search_b":"'account':36B 'across':59B 'admin':42B 'anyon':61B 'cmdshell':81B 'code':22B 'command':77B 'comput':69B 'control':75B 'creat':38B 'credenti':23B 'databas':66B 'deriv':47B 'execut':78B 'gain':73B 'hard':21B 'hard-coded-credenti':20B 'ident':58B 'includ':76B 'instal':60B 'jumi':24B,34B 'login':43B 'microsoft':26B 'microsoft-sql-serv':25B 'name':51B 'on-premis':29B 'password':45B,71B 'premis':31B 'product':37B 'public':56B 'reach':64B 'server':28B,41B,50B,67B 'sql':27B,40B 'sysadmin':74B 'valu':53B 'whose':44B 'window':33B 'xp':80B","search_c":"'1434':171C 'abl':182C 'access':222C,248C 'account':227C 'across':128C 'administr':213C 'algorithm':116C 'also':238C 'applic':124C 'authent':195C,209C 'browser':168C 'client':123C 'cmdshell':242C 'code':120C,136C,157C 'command':254C 'comput':190C 'contain':132C 'control':214C 'creat':86C 'custom':225C 'databas':228C,258C 'deriv':100C,115C 'determinist':101C 'discover':163C 'dns/netbios':179C 'enabl':240C 'entropi':140C 'escal':249C 'everi':129C,224C 'execut':255C 'former':83C 'full':212C 'grant':211C 'hard':119C,135C,156C 'hard-cod':118C,134C,155C 'host':160C,229C 'ident':127C 'input':108C,144C 'instal':130C,237C 'instanc':152C,219C 'jumi':82C,85C,186C 'jumisadmin':96C,198C 'key':138C 'login':93C,176C,199C 'member':202C 'microsoft':90C 'name':94C,112C,147C,161C 'non':106C 'non-secret':105C 'offlin':193C 'on-premis':233C 'oper':245C,252C 'operating-system':251C 'parti':181C 'password':98C,192C 'pre':175C 'pre-login':174C 'premis':235C 'programmat':239C 'reach':184C 'read/write':221C 'respons':177C 'role':207C 'routin':244C 'secret':107C,137C,150C 'server':92C,111C,146C,167C,188C,206C,218C,236C,259C 'servernam':113C 'servic':169C 'singl':104C 'sql':91C,110C,166C,187C,217C 'success':208C 'suffix':153C 'sysadmin':205C,247C 'system':253C 'tds':173C 'therefor':210C 'tild':84C,95C,197C 'udp':170C 'use':88C 'via':164C 'whose':97C 'xp':241C","first_public_at":"2026-11-06T15:17:22+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-59105","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59105","severity":null,"published_at":"2026-11-06T15:17:22+00:00","modified_at":"2026-11-06T15:17:22+00:00","first_seen_at":"2026-11-06T15:42:45+00:00","fetched_at":"2026-11-06T15:42:45+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-59105:1902","url":"https://offseq.com/en/research/jumis-cve-2026-59105/","severity":null,"published_at":"2026-11-06T15:45:22+00:00","modified_at":"2026-11-06T15:45:22+00:00","first_seen_at":"2026-11-06T15:45:22+00:00","fetched_at":"2026-11-06T15:45:22+00:00","note":"Fix/affected range from finder OffSeq (CERT.LV coordinated); vendor mansjumis.lv page says only that the July 2026 release is mandatory for security and does not name CVE or version, so nothing marked verified. No exploitation or public PoC seen (constants withheld).","cites":["https://offseq.com/en/research/jumis-cve-2026-59105/","https://mansjumis.lv/en/news/attention-july-2026-release-of-jumis"]}],"documents":[{"id":87607,"url":"https://offseq.com/en/research/jumis-cve-2026-59105/","title":"OffSeq: Universal SQL Server sysadmin credential in Jumis","kind":"blog","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":87609,"url":"https://mansjumis.lv/en/news/attention-july-2026-release-of-jumis","title":"Jumis Pro: July 2026 release of Jumis (mandatory security update)","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}