AI analysis
Claude Opus · 8 Nov 2026, 10:19 CET
Jumis accounting software uses predictable SQL Server admin password, enabling takeover
Jumis creates a SQL Server sysadmin login whose password anyone can compute from the server name. Restrict network access to Jumis SQL Server instances now and contact the vendor, as the sources list no fixed version.
In plain terms
Jumis (formerly Tildes Jumis) is accounting software that stores its data in Microsoft SQL Server, a database system. During installation it creates a special administrator account named ##Tilde_JumisAdmin##. The password for this account is not random. It is calculated by the same built-in method on every installation, and the only input is the database server's name, which is easy to find out. Anyone who can reach the database server over the network could work out the password and log in as a full administrator.
That administrator account controls the whole database server, including every accounting database stored on it. On on-premise installations the software also switches on a feature that lets database administrators run operating system commands, so an intruder could go on to take over the server machine itself. Organisations running Jumis, and accounting firms hosting several clients' books on one Jumis server, should treat this as urgent.