CVE-2026-71379: Toptech TMS7/TopHAT Fuel-Terminal Software Unauthenticated Database Export (pending analysis)

CVE-2026-71379 is an unauthenticated file-export endpoint in Toptech Systems' TMS7/TopHAT fuel-terminal management software that lets any attacker on the network export arbitrary database tables with a single crafted POST request and no credentials; Toptech shipped a fix in release 7.8, but NVD has not, as of 2026-10-31, completed its own CVSS scoring.

CVE-2026-71379 is a Files or Directories Accessible to External Parties vulnerability (CWE-552) in TMS7 and TopHAT, terminal-management software from US-based Toptech Systems used by fuel and liquid-bulk terminal operators to run automated inventory, rebranding, and dispensing workflows. NVD's description is blunt: "the file export endpoint allows any unauthenticated attacker to export arbitrary database tables by sending a crafted POST request" (NVD).

NVD tracks CVE-2026-71379 with status "Awaiting Analysis" as of 2026-10-31: it has recorded a CISA-ICS-CERT-submitted score — CVSS v3.1 10.0 (critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H, and CVSS v4.0 10.0 (critical) — both attributed to source [email protected] and typed Secondary, not NVD's own Primary rating, so this page does not show a headline severity score rather than presenting that figure as NVD-confirmed (NVD).

CISA's advisory ICSA-26-272-02, published 2026-09-29, lists the affected sectors as Energy, Chemical, and Transportation Systems with worldwide deployment, and bundles this with nine other TMS7/TopHAT 7.6.3 flaws disclosed in the same advisory, including five SQL-injection issues (CVSS 9.0), an unrestricted dangerous file-upload issue (CVSS 9.1), a session-fixation issue, an eval-injection issue, and a cross-site-scripting issue. CISA states overall exploitation "could allow an attacker to access critical data or execute arbitrary code" (CISA ICS Advisory ICSA-26-272-02).

Toptech Systems has already shipped a fix: CISA's advisory states "Toptech Systems sent a security advisory to their customers on July 20, 2026" and that "the issues have been addressed in release 7.8," directing users to the vendor's security blog for the update and further detail. Toptech's own blog post describes the 7.8 release as adding input validation, browser-script hardening, file-export authorization controls, and session-integrity improvements across the platform, alongside a database-engine upgrade path (CISA ICS Advisory ICSA-26-272-02, Toptech Systems blog).

This CVE is not listed in the CISA Known Exploited Vulnerabilities catalog as of 2026-10-30, and FIRST scores the probability of exploitation at 0.0047 (40.6th percentile) as of 2026-10-31 (CISA KEV, FIRST EPSS).

NVD has not finished its own severity analysis. In the meantime, TMS7/TopHAT operators still on 7.6.3 should upgrade to release 7.8 promptly, given the no-authentication, full-database-export impact CISA describes.

• Toptech TMS7/TopHAT's file export endpoint allows any unauthenticated attacker to export arbitrary database tables via a crafted POST request (CWE-552). — NVD
• NVD status is "Awaiting Analysis" with CISA-ICS-CERT-submitted ([email protected]) Secondary CVSS v3.1 10.0 / v4.0 10.0, no NVD-published Primary score as of 2026-10-31. — NVD
• Advisory affects Energy, Chemical, and Transportation Systems sectors worldwide, bundles nine companion CVEs in the same software version (7.6.3), and Toptech shipped a fix in release 7.8 after notifying customers 2026-07-20. — CISA ICS Advisory ICSA-26-272-02
• Not present in the CISA KEV catalog as of 2026-10-30. — CISA KEV
• EPSS score is 0.0047 (40.6th percentile) as of 2026-10-31. — FIRST EPSS