Acrel ECEMS Enterprise CVE-2026-7694

No vendor-released patch has been identified; Acrel did not respond to early disclosure notifications. Immediate mitigation requires input validation and parameterized query implementation by deploying a Web Application Firewall (WAF) with SQL injection detection rules to block requests containing SQL metacharacters in the fCircuitids parameter. Restrict network access to the /SubstationWEBV2/main/ endpoint to trusted administrative IP ranges only, using network segmentation or firewall rules. Implement database access controls to ensure the application database user account has minimal privileges (read-only access where possible, no DDL permissions). Enable SQL query logging and set up real-time alerts for suspicious SQL patterns or failed authentication attempts. Organizations should contact Acrel directly at security contact channels to request a patched version; if unavailable within a defined timeframe, consider evaluating alternative SCADA/microgrid management solutions that receive active security support. Each mitigation has trade-offs: WAF rules may block legitimate circuit queries with special characters (test before production); IP restriction limits remote monitoring capability; database read-only mode may break operational features requiring writes.