CVE-2026-7696

MediumCVSS 6.3

Published: 03/05/2026(UTC)Updated: 26/10/2026(UTC)Translated: 26/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.22%

13th percentile - higher than 13% of all known CVEs

Summary

A vulnerability was found in Acrel Electrical EEMS Enterprise Power Operation and Maintenance Cloud Platform 1.3.0 in /SubstationWEBV2/main/uploadH5Files. Manipulation of the File argument results in unrestricted upload, and the attack can be launched remotely.

Risk Assessment

A remote attacker can upload malicious files, potentially leading to code execution or system compromise. Public availability of the exploit increases the risk.

Recommendation

Upgrade the platform to a patched version or implement validation of uploaded file types and sizes. Until fixed, restrict access to the upload functionality.

Other vulnerabilities in Acrel Electrical EEMS Enterprise Power Operation and Maintenance Cloud Platform

CVE-2026-7695High
A vulnerability has been found in Acrel Electrical EEMS Enterprise Power Operation and Maintenance Cloud Platform version 1.3.0, affecting an unknown function of the file /SubstationWEBV2/main/elecMaxMinAvgValue. Manipulation of the argument fCircuitids leads to SQL injection.

Original NVD description (English source)

A vulnerability was found in Acrel Electrical EEMS Enterprise Power Operation and Maintenance Cloud Platform 1.3.0. This impacts an unknown function of the file /SubstationWEBV2/main/uploadH5Files. The manipulation of the argument File results in unrestricted upload. The attack may be launched remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS