# CVE-2026-71302: Toptech TMS7 and TopHAT session fixation

Source: https://junglewise.ai/threats/cve-2026-71302-the-application-accepts-user-supplied-session-identifiers-and  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-29. Updated: 2026-09-29  
License: CC BY 4.0 with a link back

CVE-2026-71302 · Severity: high · CVSS 7.1 · Published 2026-09-29

Toptech TMS7 and TopHAT are industrial control system software that manage critical infrastructure operations. The applications accept user-supplied session identifiers and fail to regenerate session IDs after authentication, allowing an attacker to hijack user sessions by predicting or reusing a known session ID. An attacker can impersonate legitimate users and gain unauthorized access to sensitive data or perform actions with victim privileges.

Technologies: [Toptech Systems TMS7](https://junglewise.ai/threats/technologies/tms7), [Toptech Systems TopHAT](https://junglewise.ai/threats/technologies/toptech-systems-tophat). Vendors: [Toptech Systems](https://junglewise.ai/threats/vendors/toptech-systems).

## Quick answers

**Is CVE-2026-71302 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-71302 being exploited in the wild.

**How severe is CVE-2026-71302?** High severity, with a CVSS score of 7.1, published 29 September 2026.

**Which products and versions are affected?** Toptech Systems TMS7 7.6.3; Toptech Systems TopHAT 7.6.3.

**Is there a fix for CVE-2026-71302?** A patch was published on 2026: Fixed in version 7.8 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-71302 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-71302?** Check whether you run Toptech Systems TMS7 or Toptech Systems TopHAT at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

This is a session fixation vulnerability (CWE-384) where the application fails to regenerate the session token post-authentication. An unauthenticated network attacker can predefine a session identifier, trick a user into authenticating with that session ID, and then reuse the same session token to access the application with victim privileges. No patch is currently available in the tested versions (7.6.3), though Toptech Systems released version 7.8 with remediations.

## Affected products

- Toptech Systems TMS7 7.6.3
- Toptech Systems TopHAT 7.6.3

## Timeline

- 2026-09-29: disclosed
- 2026: patched: Fixed in version 7.8

## References

- [https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-272-02.json](https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-272-02.json)
- [https://www.cisa.gov/news-events/ics-advisories/icsa-26-272-02](https://www.cisa.gov/news-events/ics-advisories/icsa-26-272-02)

## Related threats

- [Toptech TMS7 and TopHAT SQL injection in business allocation search](https://junglewise.ai/threats/cve-2026-72510-the-supplier-no-parameter-used-in-the-business-allocation-search)
- [Toptech TMS7 and TopHAT time-based blind SQL injection in report parameter](https://junglewise.ai/threats/cve-2026-72507-the-reporttype-parameter-in-the-product-summary-report-feature)
- [The file export endpoint allows any unauthenticated attacker to export arbitrary database tables by sending a crafted POST request.](https://junglewise.ai/threats/cve-2026-71379-toptech-tms7-and-tophat)
- [Toptech TMS7 unrestricted file upload in file endpoint](https://junglewise.ai/threats/cve-2026-70356-the-tms-file-upload-endpoint-fails-to-enforce-server-side-file)
- [Toptech TMS7 time-based blind SQL injection in search](https://junglewise.ai/threats/cve-2026-68954-the-pattern-parameter-used-in-search-function-in-the-home-page-of)