Toptech TMS7 and TopHAT

Summary

Toptech Systems has released version 7.8 of its TMS7 and TopHAT software to address a series of critical vulnerabilities. These flaws, affecting version 7.6.3, include SQL injection, unrestricted file uploads, session fixation, eval injection, and cross-site scripting. Successful exploitation could lead to unauthorized data access or arbitrary code execution, posing significant risks to critical infrastructure sectors like energy, chemical, and transportation.

Full text

ICS Advisory Toptech TMS7 and TopHAT Release DateSeptember 29, 2026 Alert CodeICSA-26-272-02 Related topics: Industrial Control System Vulnerabilities , Industrial Control Systems View CSAF Summary Successful exploitation of these vulnerabilities could allow an attacker to access critical data or execute arbitrary code. The following versions of Toptech TMS7 and TopHAT are affected: TMS7 7.6.3 (CVE-2026-71379, CVE-2026-70356, CVE-2026-72510, CVE-2026-63713, CVE-2026-68954, CVE-2026-68068, CVE-2026-72507, CVE-2026-71302, CVE-2026-69662, CVE-2026-71189) TopHAT 7.6.3 (CVE-2026-71379, CVE-2026-70356, CVE-2026-72510, CVE-2026-63713, CVE-2026-68954, CVE-2026-68068, CVE-2026-72507, CVE-2026-71302, CVE-2026-69662, CVE-2026-71189) CVSS Vendor Equipment Vulnerabilities v3 10 Toptech Systems Toptech TMS7 and TopHAT Files or Directories Accessible to External Parties, Unrestricted Upload of File with Dangerous Type, Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'), Session Fixation, Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection'), Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Background Critical Infrastructure Sectors: Energy, Chemical, Transportation Systems Countries/Areas Deployed: Worldwide Company Headquarters Location: United States Vulnerabilities Expand All + CVE-2026-71379 The file export endpoint allows any unauthenticated attacker to export arbitrary database tables by sending a crafted POST request. View CVE Details Affected Products Toptech TMS7 and TopHAT Vendor:Toptech Systems Product Version:Toptech Systems TMS7: 7.6.3, Toptech Systems TopHAT: 7.6.3 Product Status:known_affected Remediations MitigationToptech Systems sent a security advisory to their customers on July 20, 2026. The issues have been addressed in release 7.8. Users can get the latest release and more information on these issues, at the Toptech Systems security blog.https://www.toptech.com/blog/tms7-version-7-8-strengthens-security Relevant CWE: CWE-552 Files or Directories Accessible to External Parties Metrics CVSS Version Base Score Base Severity Vector String 3.1 10 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H 4.0 10 CRITICAL CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H CVE-2026-70356 The TMS file upload endpoint fails to enforce server-side file type restrictions, allowing an attacker to upload and execute arbitrary PHP files on the web server. View CVE Details Affected Products Toptech TMS7 and TopHAT Vendor:Toptech Systems Product Version:Toptech Systems TMS7: 7.6.3, Toptech Systems TopHAT: 7.6.3 Product Status:known_affected Remediations MitigationToptech Systems sent a security advisory to their customers on July 20, 2026. The issues have been addressed in release 7.8. Users can get the latest release and more information on these issues, at the Toptech Systems security blog.https://www.toptech.com/blog/tms7-version-7-8-strengthens-security Relevant CWE: CWE-434 Unrestricted Upload of File with Dangerous Type Metrics CVSS Version Base Score Base Severity Vector String 3.1 9.1 CRITICAL CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H 4.0 9.4 CRITICAL CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H CVE-2026-72510 The "supplier_no" parameter used in the business allocation search feature is vulnerable to time-based blind SQL injection. View CVE Details Affected Products Toptech TMS7 and TopHAT Vendor:Toptech Systems Product Version:Toptech Systems TMS7: 7.6.3, Toptech Systems TopHAT: 7.6.3 Product Status:known_affected Remediations MitigationToptech Systems sent a security advisory to their customers on July 20, 2026. The issues have been addressed in release 7.8. Users can get the latest release and more information on these issues, at the Toptech Systems security blog.https://www.toptech.com/blog/tms7-version-7-8-strengthens-security Relevant CWE: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Metrics CVSS Version Base Score Base Severity Vector String 3.1 9 CRITICAL CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:H 4.0 8.5 HIGH CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:L/VA:H/SC:H/SI:L/SA:H CVE-2026-63713 The "search" parameter in the view audit logs feature within the utilities section is susceptible to a time-based blind SQL injection vulnerability. View CVE Details Affected Products Toptech TMS7 and TopHAT Vendor:Toptech Systems Product Version:Toptech Systems TMS7: 7.6.3, Toptech Systems TopHAT: 7.6.3 Product Status:known_affected Remediations MitigationToptech Systems sent a security advisory to their customers on July 20, 2026. The issues have been addressed in release 7.8. Users can get the latest release and more information on these issues, at the Toptech Systems security blog.https://www.toptech.com/blog/tms7-version-7-8-strengthens-security Relevant CWE: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Metrics CVSS Version Base Score Base Severity Vector String 3.1 9 CRITICAL CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:H 4.0 8.5 HIGH CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:L/VA:H/SC:H/SI:L/SA:H CVE-2026-68954 The "pattern" parameter used in search function in the home page of the TMS application is vulnerable to time-based blind SQL injection vulnerability. View CVE Details Affected Products Toptech TMS7 and TopHAT Vendor:Toptech Systems Product Version:Toptech Systems TMS7: 7.6.3, Toptech Systems TopHAT: 7.6.3 Product Status:known_affected Remediations MitigationToptech Systems sent a security advisory to their customers on July 20, 2026. The issues have been addressed in release 7.8. Users can get the latest release and more information on these issues, at the Toptech Systems security blog.https://www.toptech.com/blog/tms7-version-7-8-strengthens-security Relevant CWE: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Metrics CVSS Version Base Score Base Severity Vector String 3.1 9 CRITICAL CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:H 4.0 8.5 HIGH CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:L/VA:H/SC:H/SI:L/SA:H CVE-2026-68068 The "screenID" parameter in the electronic transaction queue viewer feature within the manual transactions section is susceptible to a time-based blind SQL injection vulnerability. View CVE Details Affected Products Toptech TMS7 and TopHAT Vendor:Toptech Systems Product Version:Toptech Systems TMS7: 7.6.3, Toptech Systems TopHAT: 7.6.3 Product Status:known_affected Remediations MitigationToptech Systems sent a security advisory to their customers on July 20, 2026. The issues have been addressed in release 7.8. Users can get the latest release and more information on these issues, at the Toptech Systems security blog.https://www.toptech.com/blog/tms7-version-7-8-strengthens-security Relevant CWE: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Metrics CVSS Version Base Score Base Severity Vector String 3.1 9 CRITICAL CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:H 4.0 8.5 HIGH CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:L/VA:H/SC:H/SI:L/SA:H CVE-2026-72507 The "reportType" parameter in the product summary report feature within the balancing reports section is susceptible to a time-based blind SQL injection vulnerability. View CVE Details Affected Products Toptech TMS7 and TopHAT Vendor:Toptech Systems Product Version:Toptech Systems TMS7: 7.6.3, Toptech Systems TopHAT: 7.6.3 Product Status:known_affected Remediations MitigationToptech Systems sent a security advisory to their customers on July 20, 2026. The issues have been addressed in release 7.8. Users can get the latest release and more information on these issues, at the Toptech Systems security blog.https://www.toptech.com/blog/tms7-version-7-8-strengthens-security Relevant CWE: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Indicators of Compromise

• cve — CVE-2026-71379
• cve — CVE-2026-70356
• cve — CVE-2026-72510
• cve — CVE-2026-63713
• cve — CVE-2026-68954
• cve — CVE-2026-68068
• cve — CVE-2026-72507
• cve — CVE-2026-71302
• cve — CVE-2026-69662
• cve — CVE-2026-71189

Entities