CVE-2026-59105: Server name-derived password exposes Jumis SQL Server

Jumis admin login password derived from server name. Remotely calculable, full access to data. CVSS 9.8 critical.

CVE-2026-59105 exposes a critical flaw in Jumis (formerly Tildes Jumis), an accounting platform. The product automatically creates a SQL Server login named ##Tilde_JumisAdmin## during installation. The password for this login is deterministically calculated from a single non-secret input: the SQL Server name (@@servername). The derivation algorithm is hardcoded in the Jumis client and is identical across all installations, containing a hardcoded secret key for entropy.

Because the server name is not secret—the instance suffix is hardcoded and the hostname is discoverable via SQL Server Browser (UDP 1434), TDS pre-login response or DNS/NetBIOS—any attacker able to reach the Jumis server can compute the password offline and authenticate. The ##Tilde_JumisAdmin## login is a member of the sysadmin server role. The flaw was published on NVD on 2026-11-06, with CVSS 9.8 critical. No public exploit has been detected on GitHub repositories, but 4 posts on X have been reported in the last 24 hours.

Sysadmin access enables the execution of operating system commands, particularly because the on-premise installation enables xp_cmdshell during operation. Administrators should: 1) inventory all on-premise Jumis installations; 2) verify the presence of the ##Tilde_JumisAdmin## login; 3) restrict network access to the SQL Server to authorized clients only; 4) contact the vendor immediately for patches or workarounds; 5) if possible, disable xp_cmdshell. No official fix has been published at the time of reporting.

At a glance

What: A SQL Server login named ##Tilde_JumisAdmin## with password deterministically derived from the server name (@@servername). The derivation is hardcoded in the client, identical across all installations and contains a hardcoded secret key.
Severity: CVSS 9.8 (critical). Anyone who can reach the Jumis server can compute the password offline and authenticate as sysadmin, gaining full administrative control and read/write access to all customer databases.
Affected versions: Not reported in the official NVD description.
Fix: Not reported. Check the Jumis website or contact the vendor for patches or mitigations.
Status: Public (NVD published 2026-11-06). No public exploit detected on GitHub repositories. Coherent social signals: 4 posts in the last 24 hours.
Action: Check on-premise Jumis installations. Verify if ##Tilde_JumisAdmin## is present and active. Restrict network access to the SQL Server. Contact the vendor for patches. xp_cmdshell is enabled during operation: disable if possible.

Sources: NVD, CVE-2026-59105

← All articles