Toptech TMS7 and TopHAT

1. Executive summary

CISA published ICSA-26-272-02 on 2026-09-29 covering ten vulnerabilities in Toptech Systems TMS7 and TopHAT, a terminal management system deployed in the energy, chemical and transportation sectors worldwide. The most severe is CVE-2026-71379, a CVSS 3.1 base score of 10.0 (CRITICAL, vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H), an unauthenticated file export endpoint that returns arbitrary database tables to any attacker who sends a crafted POST request. CISA states that no known public exploitation specifically targeting these vulnerabilities has been reported at this time, and no CISA KEV entry exists for any of the ten CVEs. EMEA financial services exposure is indirect: TMS7 and TopHAT sit in the trade-finance and commodity-collateral chain, where banks finance or hold title to inventory tracked in these systems, so a compromise of a counterparty's terminal management platform can corrupt the quantity, ownership and allocation records that underpin lending decisions.

2. Regulatory framing

No DORA Art. 17, 18, 19, 24 or 29 obligation and no NIS2 Art. 23 or UK NIS 2018 duty is directly engaged by this item as published: CISA reports no known exploitation, so there is no incident to classify or report on the facts available.

3. Technical analysis & attack chain

Ten CVEs affect TMS7 7.6.3 and TopHAT 7.6.3. Toptech Systems issued a customer security advisory on 2026-07-20 and fixed all ten in release 7.8. CISA published the advisory on 2026-09-29. The confirmed chain below is the highest-severity path; the remaining flaws are described after it.

Confirmed attack chain for CVE-2026-71379 (CVSS 3.1 10.0, CRITICAL; CVSS 4.0 10.0, CRITICAL; CWE-552):

1. The attacker sends a crafted POST request to the TMS file export endpoint. No authentication is required (PR:N) and no user interaction is required (UI:N).
2. The endpoint does not restrict which database tables can be named in the request, so the attacker selects arbitrary tables.
3. The endpoint returns the contents of those tables to the attacker. The CVSS vector scores scope as changed (S:C) with high confidentiality, integrity and availability impact, so the flaw is not limited to reading the named table.

The file export endpoint is the entry point that matters most. It is unauthenticated, network-reachable and returns database content directly, which means an attacker needs no foothold, no credential and no user on the target to pull data out.

CVE-2026-70356 (CVSS 3.1 9.1, CRITICAL; CVSS 4.0 9.4, CRITICAL; CWE-434) is the second path and the one that yields code execution. The TMS file upload endpoint does not enforce server-side file type restrictions, so an authenticated attacker (PR:H) can upload a PHP file and have the web server execute it. This is remote code execution on the TMS web server, and it is the step that turns a data-read flaw into control of the host.

Six time-based blind SQL injection flaws sit at CVSS 3.1 9.0 (CRITICAL) and CVSS 4.0 8.5 (HIGH), all CWE-89, all requiring high privilege (PR:H). Each is in a named parameter, which is what a defender needs for log review:

• CVE-2026-72510: the supplier_no parameter in the business allocation search feature.
• CVE-2026-63713: the search parameter in the view audit logs feature under the utilities section.
• CVE-2026-68954: the pattern parameter in the search function on the TMS application home page.
• CVE-2026-72507: the screenID parameter in the electronic transaction queue viewer under the manual transactions section.
• CVE-2026-71302: the reportType parameter in the product summary report under the balancing reports section.
• CVE-2026-71189: a sixth time-based blind SQL injection, listed against both products at the same CVSS 3.1 9.0 / CVSS 4.0 8.5 scores; CISA's advisory does not name the parameter or feature for this one.

Because these are blind, the attacker infers data one bit at a time from response timing rather than reading output. Detection therefore depends on request timing patterns against those five named parameters, not on error strings.

CVE-2026-69662 (CVSS 3.1 7.1, HIGH; CVSS 4.0 7.5, HIGH; CWE-384) is session fixation. The application accepts user-supplied session identifiers and does not regenerate the session ID after authentication. An attacker sets a session ID in advance, waits for the victim to authenticate, then reuses that ID to take over the authenticated session. This requires user interaction (UI:R on the 3.1 vector, UI:A on the 4.0 vector) and is the natural way to obtain the high privilege that the six SQL injection flaws require.

CVE-2026-71189 aside, the two low-severity flaws are CWE-95 eval injection at CVSS 3.1 3.7 (LOW) / CVSS 4.0 2.1 (LOW), where the application uses unsafe functions permitting inline script execution and string evaluation, and CWE-79 cross-site scripting at CVSS 3.1 3.5 (LOW) / CVSS 4.0 4.8 (MEDIUM), where an attacker constructs a request that, if issued by another application user, executes attacker-supplied JavaScript in that user's browser in the context of their session.

Read together, the chain is: fix the session (CVE-2026-69662) or obtain credentials, use the resulting high privilege to run blind SQL injection against the allocation, audit log, home page search, transaction queue or balancing report parameters, and separately use the unauthenticated export endpoint (CVE-2026-71379) to pull tables without any credential at all. The upload endpoint (CVE-2026-70356) converts any authenticated access into PHP code execution on the web server.

Confidence caveats. All ten CVEs, their parameters, their CWEs and their CVSS vectors come from a single source, CISA advisory ICSA-26-272-02, which is itself relaying Toptech Systems' 2026-07-20 customer advisory. No independent technical write-up, proof of concept or exploitation report was available at the time of writing. The parameter names and feature locations are as CISA published them and have not been independently verified. CISA states no known public exploitation targeting these vulnerabilities has been reported to it, and there is no CISA KEV entry for any of the ten CVEs; treat exploitation as not yet observed rather than as not possible. No MITRE ATT&CK profile is associated with this item and no actor is named in any source, so there is no attribution to assess.

4. Mitigation & containment

P1 (within 24 hours)

• Inventory TMS7 and TopHAT instances across your estate and across counterparties whose records you rely on. The affected version is 7.6.3 for both products. If you operate either product, treat the file export endpoint as internet-exposed until proven otherwise.
• If you cannot patch immediately, block network access to the TMS file export endpoint at the reverse proxy or WAF, and restrict the TMS web interface to known operator networks. CISA's advisory does not publish the endpoint path, so identify it from your own TMS deployment before writing the rule.
• Disable or restrict the TMS file upload endpoint until release 7.8 is applied. This is the path to PHP code execution (CVE-2026-70356).
• Search web and proxy logs for POST requests to the export endpoint from unauthenticated sessions, and for POST requests carrying PHP file content to the upload endpoint.

P2 (within 72 hours)

• Upgrade TMS7 and TopHAT to release 7.8, the version in which Toptech Systems fixed all ten issues. The vendor's release note is at https://www.toptech.com/blog/tms7-version-7-8-strengthens-security and the vendor notified customers on 2026-07-20.
• Where you do not operate the system yourself, ask the operator or counterparty to confirm in writing that release 7.8 is applied, and record the date. This is the DORA Art. 28 and Art. 30 point: the fix is theirs to apply, and your assurance depends on the contract.
• Review authentication logs for session IDs that appear before the corresponding login event, or that are reused across users. That pattern is the signature of CVE-2026-69662 session fixation.
• Review request logs for the five named SQL injection parameters: supplier_no, search (view audit logs, utilities section), pattern (home page search), screenID (electronic transaction queue viewer, manual transactions), reportType (product summary report, balancing reports). Time-based blind injection shows as repeated requests with response times that vary with the parameter value rather than as errors.

P3 (within 7 days)

• Rotate credentials and invalidate active sessions on any TMS7 or TopHAT instance that was reachable from an untrusted network before release 7.8 was applied.
• Reconcile allocation, balancing and transaction queue records against independent sources if the export endpoint was reachable, because CVE-2026-71379 returns arbitrary tables without authentication and the integrity impact is scored high.
• Confirm that the counterparty's contract obliges security notification and timely patching for this product, and that you have a route to audit compliance. DORA Art. 30 governs the contractual provisions; DORA Art. 28 governs the third-party risk principle.

5. Indicators of compromise

No atomic indicators of compromise are available in the source material. CISA's advisory names no hashes, domains, IP addresses, file paths or filenames, and reports no observed exploitation.

The sources do describe observable behaviours. These are listed separately and are not machine-pivotable atomic indicators.

Behavioural indicators

6. Detection

The sources give parameter names and feature locations but no file artefacts, command lines, mutexes or hard-coded strings from the vulnerabilities themselves. The parameter names are the only distinctive artefacts available, and they are generic enough that a YARA rule built on them would match legitimate application code and reporting about the flaw rather than the flaw. No YARA rule is emitted for that reason.

A Sigma rule is appropriate for the log-side behaviour, using the named parameters and the export and upload endpoints. The endpoint paths are not published by CISA, so the rule uses the parameter names and leaves the path as a field the analyst fills in from their own deployment.

title: Toptech TMS7 and TopHAT exploitation attempt indicators
id: 8f4c1a2e-6b7d-4e91-9c3a-2d5f7a1b0e44
status: experimental
description: Detects HTTP requests matching the vulnerable parameters and endpoints described in CISA ICSA-26-272-02 for Toptech TMS7 and TopHAT 7.6.3. Endpoint paths are not published by the advisory and must be set per deployment.
author: Adverse Trace
date: 2026-09-29
references:

  - https://www.cisa.gov/news-events/ics-advisories/icsa-26-272-02
  - https://www.toptech.com/blog/tms7-version-7-8-strengthens-security
logsource:
  category: webserver
detection:
  selection_sqli_params:
    cs-uri-query|contains:

      - 'supplier_no='
      - 'screenID='
      - 'reportType='
  selection_search_params:
    cs-uri-query|contains:

      - 'search='
      - 'pattern='
  selection_php_upload:
    cs-method: 'POST'
    cs-uri-query|contains:

      - 'upload'
    cs-uri-query|endswith:

      - '.php'
  selection_export:
    cs-method: 'POST'
    cs-uri-query|contains:

      - 'export'
  condition: selection_sqli_params or selection_search_params or selection_php_upload or selection_export
falsepositives:

  - Legitimate use of the business allocation search, audit log search, home page search, transaction queue viewer and balancing report features by authenticated operators
  - Legitimate file uploads to the TMS upload endpoint
  - Legitimate use of the file export endpoint by authenticated administrators
level: medium

The rule is deliberately broad because the advisory does not publish endpoint paths or payload syntax. Tune it against your own TMS traffic before enabling alerting, and treat the selection_export and selection_php_upload branches as the higher-priority alerts.

7. Sources

• CISA, "Toptech TMS7 and TopHAT", ICSA-26-272-02, published 2026-09-29. https://www.cisa.gov/news-events/ics-advisories/icsa-26-272-02
• Toptech Systems, "TMS7 version 7.8 strengthens security", vendor security blog, referenced in the CISA advisory. https://www.toptech.com/blog/tms7-version-7-8-strengthens-security

8. Adverse Trace position

Adverse Trace assesses CVE-2026-71379 at CVSS 3.1 10.0 (CRITICAL) and CVE-2026-70356 at CVSS 3.1 9.1 (CRITICAL), with the six SQL injection flaws at CVSS 3.1 9.0 (CRITICAL), per the CISA advisory; no CISA KEV entry exists for any of the ten CVEs and CISA reports no known public exploitation, so this is a patch-now advisory rather than an active-incident one. The client impact for EMEA financial services is concentrated in trade finance and commodity collateral: if a bank relies on TMS7 or TopHAT records held by a terminal operator or counterparty, an unauthenticated export of arbitrary database tables can corrupt the quantity and allocation data behind a lending or collateral decision, and the fix is the counterparty's to apply. All technical detail here is single-sourced from CISA ICSA-26-272-02, which relays the vendor's 2026-07-20 advisory; the parameter names and feature locations have not been independently verified, and no actor is named in any source, so there is no attribution to make. We will monitor for a public proof of concept, for any CISA KEV addition, and for vendor or researcher write-ups that confirm the endpoint paths, and we will issue a follow-up if exploitation is observed or if the endpoint details become available. Clients who operate TMS7 or TopHAT should treat release 7.8 as the only remediation and should not wait for exploitation reporting before applying it.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.