Which versions of Toptech TMS7 are affected by EUVD-2026-89472?

Toptech Systems TMS7 and TopHat terminal management software are affected by a high-severity SQL injection vulnerability that requires an authenticated high-privilege session to exploit, potentially…

How to fix or mitigate EUVD-2026-89472?

Vendor-released patch: TMS7 version 7.8. Within 24 hours, identify all instances of Toptech Systems TMS7 (versions prior to 7.8) and TopHat, and restrict high-privilege access to the manual transactions section of the electronic transaction queue viewer to only essential personnel; review web server logs for anomalous screenID parameter patterns or unusual response-time delays. Within 7 days, schedule and begin upgrading affected TMS7 installations to version 7.8, and apply any available vendor workarounds for TopHat if no patch is yet released; enable enhanced monitoring for SQL injection attempts and audit privileged user activity. Within 30 days, complete all upgrades to TMS7 7.8, verify remediation through testing, conduct a full review of privileged accounts with access to the vulnerable interface, and implement least-privilege principles to minimize future exposure.

Toptech TMS7 EUVD-2026-89472

Q: What is the CVSS score of EUVD-2026-89472?

EUVD-2026-89472 has a CVSS 4.0 base score of 8.5 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:L/VA:H/SC:H/SI:L/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

| CVE-2026-68068 HIGH

SQL Injection (CWE-89)

2026-09-29 icscert

GHSA-9937-82gg-hhhm

SQLi Tophat Toptech Systems Tms7

8.5

CVSS 4.0 · Vendor: icscert

Severity by source

Vendor (icscert) PRIMARY

8.5 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:L/VA:H/SC:H/SI:L/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.0 MEDIUM

Network-reachable app feature (AV:N/AC:L) but needs high-privilege authentication (PR:H); blind SQLi yields strong data read (C:H) with limited write/DoS (I:L/A:L), same system (S:U).

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (icscert).

CVSS VectorVendor: icscert

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Metadata Corrected

Sep 29, 2026 - 22:40 vuln.today

tag: Toptech Systems added

Analysis Updated

Sep 29, 2026 - 22:31 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Sep 29, 2026 - 22:22 vuln.today

cvss_changed

Severity Changed

Sep 29, 2026 - 22:22 NVD

CRITICAL HIGH

CVSS changed

Sep 29, 2026 - 22:22 NVD

9.0 (CRITICAL) 8.5 (HIGH)

Analysis Generated

Sep 29, 2026 - 22:10 vuln.today

CVE Published

Sep 29, 2026 - 21:33 cve.org

CRITICAL 9.0

DescriptionCVE.org

The "screenID" parameter in the electronic transaction queue viewer feature within the manual transactions section is susceptible to a time-based blind SQL injection vulnerability.

AnalysisAI

Time-based blind SQL injection in Toptech Systems TMS7 and TopHat terminal management software lets an authenticated high-privilege user inject SQL through the 'screenID' parameter of the electronic transaction queue viewer in the manual transactions section, using response-time delays to infer database contents. Exploitation requires an existing high-privilege (PR:H) session on the affected web interface, so anonymous and low-privilege users are excluded, and the blind, inference-based technique makes data extraction slow rather than directly returned. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	Requires an authenticated high-privilege (PR:H) session to the TMS7/TopHat web application; the attacker must reach the electronic transaction queue viewer within the manual transactions section and manipulate the 'screenID' parameter. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	This is an authenticated (PR:H) time-based blind SQL injection in a niche OT product (Toptech Systems TMS7/TopHat, petroleum terminal management), so despite the vendor's 8.5 CVSS 4.0 score the real-world priority is moderate at most. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	The primary fix is to upgrade to TMS7 version 7.8, the release in which the vendor states security is strengthened and this injection is remediated (see https://www.toptech.com/blog/tms7-version-7-8-strengthens-security and ICSA-26-272-02 at https://www.cisa.gov/news-events/ics-advisories/icsa-26-272-02, CSAF copy at https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-272-02.json). … Detailed patch versions, workarounds, and compensating controls in full report.