External risk intelligence

Jumis SQL Server Password Derivation Vulnerability Grants Full Administrative Control.

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-59105

The vulnerability affects a Microsoft SQL Server instance used by the Jumis accounting software. While SQL Server is a network-accessible service, it is typically deployed within internal, protected network segments rather than being exposed directly to the public internet. Access from the internet is uncommon and usually requires specific, unusual configuration or proxying, placing it outside the typical public-facing service profile.

Halo Surface Signal: 2 out of 5 — less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in the Jumis accounting software that affects its use of Microsoft SQL Server. This issue allows unauthorized parties to gain full administrative control over the database server and execute operating system commands, potentially impacting sensitive customer accounting data. The main concern is confirming whether this specific technology is in use and exposed to risk.

Software allows unauthorized server control.
Admins need awareness of this database flaw.
Confirm software use and exposure to risk.

Attack Path

How an attacker could exploit the issue

An attacker can discover the Microsoft SQL Server name, then use a hard-coded algorithm and a hard-coded secret key to calculate the password for the `##Tilde_JumisAdmin##` login offline. Once authenticated as this administrator, the attacker gains full control over the SQL Server instance and can execute operating system commands on the server.

Network access to SQL Server is required.
Calculate password offline and authenticate.
Full server control and OS command execution.

Live Threat

Current exploitation, exposure, and threat context

Attackers who can reach a Jumis SQL Server could compute its administrator password offline and gain full control of the server. This includes the ability to execute operating system commands on the database server.

Server administrative access and customer accounting data.
Password calculation via server name.
Full server and OS command execution.

Operational Fix

Recommended remediation, mitigation, and detection steps

The Jumis application's hardcoded credential derivation logic affects Microsoft SQL Server instances. Infrastructure or platform teams managing these SQL Server instances are likely responsible for addressing this vulnerability. The first step is to identify all instances running Jumis, determine their network reachability, confirm business criticality, and then assign an owner for remediation planning.

Identify responsible application/platform owners.
Verify network reachability and business criticality.
Plan risk-based remediation actions.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Jumis software?

Jumis is an accounting software package that utilizes a Microsoft SQL Server database as its backend to store and manage financial records for customers. It relies on a specialized database login for administrative tasks, which is the component currently under investigation for security risks.

Why is CVE-2026-59105 considered a security weakness?

This vulnerability involves the use of hard-coded credentials and insecure password derivation, categorized as CWE-547 and CWE-1391. Because the application uses a predictable formula based on the server name to create an administrative password, an attacker can determine these credentials without needing access to the actual software installation.

How does an attacker trigger this vulnerability?

An attacker must have network connectivity to the Microsoft SQL Server instance used by Jumis. Once connected, they can retrieve the server name and apply the hard-coded derivation algorithm offline to calculate the administrative password. This flaw is not triggered by user interaction; it is inherently exploitable by any party that can reach the database port.

Is my Jumis server at risk?

Halo Surface Signal indicates that while these servers are network-accessible, they are typically hosted within internal network segments rather than exposed directly to the public internet. If your SQL Server instance is strictly isolated from the internet, the likelihood of remote exploitation is significantly lower than for publicly reachable systems.

What are the first steps to address this issue?

Start by identifying all deployed instances of the Jumis accounting software within your environment. Once you have a complete inventory, verify the network reachability of these SQL Server instances to confirm if they are reachable from untrusted networks. Assign an owner to each instance to evaluate the risk and coordinate remediation planning with your platform team.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.