# CVE-2026-68068: Toptech TMS7 and TopHAT SQL injection in transaction queue viewer

Source: https://junglewise.ai/threats/cve-2026-68068-the-screenid-parameter-in-the-electronic-transaction-queue-viewer  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-29. Updated: 2026-09-29  
License: CC BY 4.0 with a link back

CVE-2026-68068 · Severity: critical · CVSS 9 · Published 2026-09-29

Toptech TMS7 and TopHAT are transaction management systems used in energy, chemical, and transportation sectors. The screenID parameter in the electronic transaction queue viewer contains a time-based blind SQL injection flaw that allows authenticated attackers to extract sensitive database information. Successful exploitation could lead to unauthorized access to critical operational data or system compromise.

Technologies: [Toptech Systems TMS7](https://junglewise.ai/threats/technologies/tms7), [Toptech Systems TopHAT](https://junglewise.ai/threats/technologies/toptech-systems-tophat). Vendors: [Toptech Systems](https://junglewise.ai/threats/vendors/toptech-systems).

## Quick answers

**Is CVE-2026-68068 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-68068 being exploited in the wild.

**How severe is CVE-2026-68068?** Critical severity, with a CVSS score of 9, published 29 September 2026.

**Which products and versions are affected?** Toptech Systems TMS7 7.6.3; Toptech Systems TopHAT 7.6.3.

**Is there a fix for CVE-2026-68068?** A patch was published on 2026: Fixed in version 7.8 per Toptech security advisory from July 20, 2026 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-68068 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-68068?** Check whether you run Toptech Systems TMS7 or Toptech Systems TopHAT at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A time-based blind SQL injection vulnerability exists in the screenID parameter of the electronic transaction queue viewer feature within the manual transactions section. The vulnerability requires authenticated access and a network connection to the affected web interface. Exploitation allows an attacker to infer database contents through response timing analysis, potentially extracting sensitive data or enumerating the database schema.

## Affected products

- Toptech Systems TMS7 7.6.3
- Toptech Systems TopHAT 7.6.3

## Timeline

- 2026-09-29: disclosed: CISA advisory ICSA-26-272-02 published
- 2026: patched: Fixed in version 7.8 per Toptech security advisory from July 20, 2026

## References

- [https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-272-02.json](https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-272-02.json)
- [https://www.cisa.gov/news-events/ics-advisories/icsa-26-272-02](https://www.cisa.gov/news-events/ics-advisories/icsa-26-272-02)

## Related threats

- [Toptech TMS7 and TopHAT SQL injection in business allocation search](https://junglewise.ai/threats/cve-2026-72510-the-supplier-no-parameter-used-in-the-business-allocation-search)
- [Toptech TMS7 and TopHAT time-based blind SQL injection in report parameter](https://junglewise.ai/threats/cve-2026-72507-the-reporttype-parameter-in-the-product-summary-report-feature)
- [The file export endpoint allows any unauthenticated attacker to export arbitrary database tables by sending a crafted POST request.](https://junglewise.ai/threats/cve-2026-71379-toptech-tms7-and-tophat)
- [Toptech TMS7 and TopHAT session fixation](https://junglewise.ai/threats/cve-2026-71302-the-application-accepts-user-supplied-session-identifiers-and)
- [Toptech TMS7 unrestricted file upload in file endpoint](https://junglewise.ai/threats/cve-2026-70356-the-tms-file-upload-endpoint-fails-to-enforce-server-side-file)