The vulnerability identified as CVE-2026-72510 affects Toptech Systems TMS7 version 7.6.3. It involves a time-based blind SQL injection flaw in the "supplier_no" parameter used in the business allocation search feature. This allows an attacker with high privileges to execute crafted SQL queries that can extract sensitive data or disrupt service. The CVSS 3.1 score is 9.0, indicating critical severity with network attack vector, low attack complexity, high privileges required, no user interaction, and scope changed. The impact includes high confidentiality loss, partial integrity loss, and high availability loss. No vendor advisory or patch information is available at this time.

Successful exploitation can lead to unauthorized data disclosure (high confidentiality impact), partial modification or corruption of data (integrity impact), and disruption or denial of service (high availability impact). The vulnerability requires high privileges but can be exploited remotely over the network without user interaction. The scope of impact extends beyond the vulnerable component.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected feature to trusted users only and monitor for suspicious activity related to SQL injection attempts.