A CVSS 10.0 in Fuel Terminal Software
ICSA-26-272-02 lists ten flaws in Toptech TMS7 7.6.3, headed by an unauthenticated POST that exports arbitrary database tables, plus an upload endpoint that will run PHP.
CISA published ICSA-26-272-02 on 29 September, covering ten vulnerabilities in Toptech Systems' TMS7 terminal management system and TopHAT, both at version 7.6.3.
The headline is CVE-2026-71379, scored 10.0 on both CVSS v3.1 and v4.0. CISA's description leaves little to interpret: the file export endpoint allows any unauthenticated attacker to export arbitrary database tables by sending a crafted POST request. Behind it sits CVE-2026-70356 at 9.1 and 9.4, an unrestricted file upload — the endpoint does not enforce server-side type checks, so an attacker can upload and execute arbitrary PHP.
Then five separate SQL injection flaws, each 9.0 on v3.1: in supplier search (CVE-2026-72510), audit logs (CVE-2026-63713), the homepage search (CVE-2026-68954), the transaction queue (CVE-2026-68068) and product reports (CVE-2026-72507). A session fixation issue, CVE-2026-71302, scores 7.1 because the application accepts user-supplied session identifiers and does not regenerate the session ID after authentication. An eval injection and a cross-site scripting flaw round out the list at low severity.
Toptech fixed everything in release 7.8 and notified customers directly on 20 July, more than two months before the public advisory. The findings came from Sachin Shetty and Roy Duisters of Shell CyberDefence. Listed sectors are energy, chemical and transportation systems.
What this software does is the reason the scores matter. TMS7 meters and authorises hydrocarbon loading at fuel terminals, so the database it holds is both safety-relevant and commercially sensitive — movements, customers, volumes, authorisations. An unauthenticated export is a disclosure of all of it, and the PHP upload on top means a single internet-reachable instance is a complete compromise with no credentials required.
The two-month gap between customer notification and public advisory is worth noting on its own. Operators who read vendor advisories knew in July. Those who rely on CISA found out at the end of September, and a 10.0 is not a score you want to learn about late.