CVE-2026-7695
Published: 03 May 2026
Summary
CVE-2026-7695 is a medium-severity Injection (CWE-74) vulnerability in Feishu (inferred from references). Its CVSS base score is 5.5 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 2.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 RA-5 (Vulnerability Monitoring and Scanning) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2026-7695 is a SQL injection vulnerability (CWE-74, CWE-89) in Acrel Electrical EEMS Enterprise Power Operation and Maintenance Cloud Platform version 1.3.0. The issue resides in an unknown function of the file /SubstationWEBV2/main/elecMaxMinAvgValue, where manipulation of the fCircuitids argument triggers the injection.
Unauthenticated remote attackers can exploit this vulnerability over the network with low attack complexity and no user interaction required. Exploitation yields limited impacts on confidentiality, integrity, and availability, resulting in a CVSS v3.1 base score of 7.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L).
Advisories referenced in VulDB entries (vuldb.com/?submit/803275, vuldb.com/?vuln/360864, vuldb.com/?vuln/360864/cti) and a Feishu wiki (ucn9h68n9289.feishu.cn/wiki/QoXfwTAOiiYw2OkO0vAc7b7SnGg) document the issue, noting that the vendor was contacted early but provided no response. No patches or specific mitigations are detailed.
The exploit has been publicly disclosed and may be used in attacks.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-26833
Vulnerability details
A vulnerability has been found in Acrel Electrical EEMS Enterprise Power Operation and Maintenance Cloud Platform 1.3.0. This affects an unknown function of the file /SubstationWEBV2/main/elecMaxMinAvgValue. The manipulation of the argument fCircuitids leads to sql injection. The attack may be…
more
initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Unauthenticated SQL injection in a network-accessible web endpoint of a cloud platform directly enables remote exploitation of a public-facing application.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
SI-10 mandates validation of inputs like the fCircuitids parameter to reject malicious SQL injection payloads before they reach the database.
SI-2 requires identification, reporting, and correction of flaws such as this SQL injection vulnerability through patching or code remediation.
RA-5 ensures vulnerability scanning detects SQL injection issues like CVE-2026-7695 in web applications prior to exploitation.