AI analysis
CVE-2026-68068 is a time-based blind SQL injection (CWE-89) in Toptech TMS7 and TopHAT. An attacker who already has high-privilege access can trigger it over the network by supplying a crafted screenID value to the electronic transaction queue viewer in the manual transactions section, with no user interaction required. Successful exploitation can expose sensitive database contents and can also affect integrity and availability of the vulnerable system and related systems, as reflected in the CVSS 4.0 score of 8.5. The products are industrial terminal-management systems typically deployed at bulk-liquid and petroleum terminals; affected version ranges were not stated in the supplied data. It is not listed in CISA KEV, no public proof-of-concept is known, and exploitation maturity is not scored.
What to do: Apply the vendor's security update for TMS7 and TopHAT as soon as Toptech publishes a fixed build, and until then restrict the manual-transactions and electronic transaction queue viewer to trusted high-privilege accounts only. Keep these systems off the public internet, enforce network segmentation, and review logs for unusual or delayed responses to the screenID parameter. Confirm the installed product and version against the ICS-CERT advisory rather than assuming a patch level.
Affected
| Toptech TMS7 | — |
| Toptech TopHAT | — |
Estimated exposure
nicheunknown (likely hundreds to low thousands of terminal sites) — No public install counts or internet-scan totals were available; the estimate reflects that TMS7 and TopHAT are specialized bulk-liquid terminal management systems used at fuel and similar terminals rather than mass-market software.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.