CVE-2026-7694 is a SQL injection vulnerability in Acrel Electrical ECEMS Enterprise Microgrid Energy Efficiency Management System version 1.3.0. The flaw exists in an unknown function within the file /SubstationWEBV2/main/elecMaxMinAvgValue, where manipulation of the argument fCircuitids can lead to SQL injection. The vulnerability can be exploited remotely without authentication. Exploit code has been published, but the vendor has not responded or provided a fix.