Critical severity9.0NVD Advisory· Published Sep 29, 2026

CVE-2026-72507

Description

The "reportType" parameter in the product summary report feature within the balancing reports section is susceptible to a time-based blind SQL injection vulnerability.

Affected products

Cisagov/Csafllm-fuzzy

Patches

Vulnerability mechanics

References

github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-272-02.jsonnvd
www.cisa.gov/news-events/ics-advisories/icsa-26-272-02nvd
www.toptech.com/blog/tms7-version-7-8-strengthens-securitynvd

News mentions

Toptech TMS7 and TopHAT
CISA ICS Advisories

cvss	0.585
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000