Toptech TMS7 and TopHAT
CISA warns Toptech TMS7 and TopHAT 7.6.3 have critical flaws, including unauthenticated database export.
CISA ICS advisory ICSA-26-272-02 covers Toptech Systems TMS7 7.6.3 and TopHAT 7.6.3, deployed in energy, chemical, and transportation. CVE-2026-71379 (CVSS 10.0) lets any unauthenticated attacker export arbitrary database tables. CVE-2026-70356 (CVSS 9.1) allows upload and execution of arbitrary PHP files, and five time-based blind SQL injection flaws score CVSS 9.0. Additional issues include session fixation, cross-site scripting, and eval injection; ten CVE identifiers are listed.
66