The vulnerability CVE-2026-7695 affects Acrel Electrical EEMS Enterprise Power Operation and Maintenance Cloud Platform version 1.3.0. It allows an unauthenticated remote attacker to perform SQL injection by manipulating the fCircuitids argument in the /SubstationWEBV2/main/elecMaxMinAvgValue endpoint. This could potentially lead to unauthorized data access or modification. The vendor has not issued any response or patch, and the remediation status is unknown. The CVSS 4.0 base score is 6.9, indicating medium severity with network attack vector, low complexity, no privileges or user interaction required, and low to limited impact on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data disclosure, modification, or deletion. Given the medium severity score and limited impact ratings, the impact is significant but not critical. No known active exploitation has been reported, but public disclosure of the exploit increases risk.

No official patch or remediation guidance is currently available from the vendor. Since the vendor has not responded to the disclosure, users should consider implementing application-layer protections such as input validation, parameterized queries, or web application firewalls to mitigate SQL injection risks. Monitor for vendor advisories for any future patches or updates. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.