---
id: "CVE-2026-59105"
page: "https://infrastack.ai/live/CVE-2026-59105"
kind: "vulnerability"
aliases: ["CVE-2026-59105"]
title: "Jumis accounting: hard-coded SQL Server admin password lets anyone take over"
severity: "critical"
cvss: 9.8
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "Jumis", "fixed": ["TJ7.0.141.36"], "affected": "< TJ7.0.141.36", "ecosystem": "vendor"}]
ecosystems: []
tags: ["hard-coded-credentials", "jumis", "microsoft-sql-server", "on-premise", "other", "windows"]
not_affected_if: ["no-jumis-installed", "sql-server-not-reachable"]
published_at: "2026-11-06T15:17:22+00:00"
first_seen_at: "2026-11-06T15:42:45+00:00"
updated_at: "2026-11-06T15:45:22+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59105", "first_seen_at": "2026-11-06T15:42:45+00:00"}, {"source": "analyst", "url": "https://offseq.com/en/research/jumis-cve-2026-59105/", "first_seen_at": "2026-11-06T15:45:22+00:00", "cites": ["https://offseq.com/en/research/jumis-cve-2026-59105/", "https://mansjumis.lv/en/news/attention-july-2026-release-of-jumis"]}]
exploit_sources: []
---

# Jumis accounting: hard-coded SQL Server admin password lets anyone take over

Link for people: https://infrastack.ai/live/CVE-2026-59105 (this .md is for agents)

Jumis, an accounting product, creates a SQL Server admin login whose password is derived from the server name, a value that is public and identical across installations. Anyone who can reach the database server can compute the password and gain sysadmin control, including command execution through xp_cmdshell.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Jumis affected < TJ7.0.141.36 fixed TJ7.0.141.36

## How to check

- Check the Jumis version: anything older than TJ7.0.141.36 is affected (July 2026 release; the finder tested 7.0.140).
- In SQL Server Management Studio, look under Security > Logins for ##Tilde_JumisAdmin## on the instance, or run: SELECT name FROM sys.server_principals WHERE name = '##Tilde_JumisAdmin##'
- Check whether the login is in the sysadmin role and whether xp_cmdshell is enabled (sp_configure 'xp_cmdshell').
- After updating, the finder says the login should hold only a limited public account in legacy databases and none in new ones.
- Check that UDP 1434 and the SQL port are not reachable from untrusted networks.

## Fix

Update Jumis to release TJ7.0.141.36 (July 2026 release) or later; latest per OffSeq is TJ7.0.142.7. Until updated, restrict network access to the SQL Server to hosts that need it.

## Timeline

- 2026-11-06T15:42:45+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-59105
- 2026-11-06T15:45:22+00:00 analyst https://offseq.com/en/research/jumis-cve-2026-59105/ — Fix/affected range from finder OffSeq (CERT.LV coordinated); vendor mansjumis.lv page says only that the July 2026 release is mandatory for security and does not name CVE or version, so nothing marked verified. No exploitation or public PoC seen (constants withheld).

## Documents

- [describes] OffSeq: Universal SQL Server sysadmin credential in Jumis https://offseq.com/en/research/jumis-cve-2026-59105/
- [fix] Jumis Pro: July 2026 release of Jumis (mandatory security update) https://mansjumis.lv/en/news/attention-july-2026-release-of-jumis

## From the sources

Jumis (formerly Tildes Jumis) creates and uses a Microsoft SQL Server login named ##Tilde_JumisAdmin## whose password is derived deterministically from a single non-secret input - the SQL Server name (@@servername). The derivation algorithm is hard-coded in the client application and is identical across every installation; it contains a hard-coded secret key for entropy. Because the only input (the server name) is not secret - the instance suffix is hard-coded and the host name is discoverable via the SQL Server Browser service (UDP 1434), the TDS pre-login response, or DNS/NetBIOS - any party able to reach a Jumis SQL Server can compute the password offline and authenticate. The ##Tilde_JumisAdmin## login is a member of the sysadmin server role. Successful authentication therefore grants full administrative control of the SQL Server instance and read/write access to every customer's accounting database hosted on it. The on-premise server installation also programmatically enables xp_cmdshell during routine operation, so sysadmin access escalates to operating-system command execution on the database server.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_