CVE-2026-7696: Acrel EEMS Platform RCE Vulnerability

CVE-2026-7696 Overview

CVE-2026-7696 is an unrestricted file upload vulnerability affecting Acrel Electrical EEMS Enterprise Power Operation and Maintenance Cloud Platform version 1.3.0. The flaw resides in the /SubstationWEBV2/main/uploadH5Files endpoint, where manipulation of the File argument allows unrestricted upload of arbitrary files. The issue is classified under CWE-284 (Improper Access Control). Authenticated remote attackers can exploit the endpoint over the network with low complexity. The exploit has been publicly disclosed, and the vendor did not respond to disclosure attempts.

Critical Impact

Authenticated remote attackers can upload arbitrary files to the EEMS platform, potentially staging follow-on attacks against the operational technology environment used for power monitoring.

Affected Products

• Acrel Electrical EEMS Enterprise Power Operation and Maintenance Cloud Platform 1.3.0
• Component: /SubstationWEBV2/main/uploadH5Files endpoint
• Parameter: File

Discovery Timeline

• 2026-05-03 - CVE-2026-7696 published to NVD
• 2026-05-05 - Last updated in NVD database

Technical Details for CVE-2026-7696

Vulnerability Analysis

The vulnerability resides in an unspecified handler tied to the /SubstationWEBV2/main/uploadH5Files URI. The handler accepts a File parameter without enforcing restrictions on file type, content, or destination path. This pattern aligns with CWE-284, where access controls on a sensitive operation are missing or insufficient.

Acrel EEMS is a cloud platform used to monitor and operate electrical substations and enterprise power infrastructure. An attacker with low-privilege authenticated access can submit a crafted upload request and place attacker-controlled files on the server. Depending on server configuration and where uploaded files are written, this can lead to web shell deployment, content tampering, or pivoting into the underlying operational environment. According to VulDB references, exploit details have been made public, increasing opportunistic risk.

Root Cause

The root cause is the absence of validation and access control on the uploadH5Files upload routine. The application does not verify file extension, MIME type, content signature, or caller authorization before persisting the uploaded artifact.

Attack Vector

Exploitation occurs over the network against the EEMS web interface. The attacker authenticates with low-privilege credentials, then issues an HTTP POST request to /SubstationWEBV2/main/uploadH5Files with a malicious payload supplied through the File parameter. No user interaction is required.

No verified exploitation code is published in trusted repositories at this time. Refer to the VulDB Vulnerability #360865 entry for technical disclosure details.

Detection Methods for CVE-2026-7696

Indicators of Compromise

• HTTP POST requests to /SubstationWEBV2/main/uploadH5Files containing executable file extensions such as .jsp, .jspx, .war, or .html with embedded scripts.
• Newly created files in EEMS upload directories with timestamps that do not align with operator activity windows.
• Outbound connections from the EEMS application server to unknown hosts shortly after upload requests, suggesting web shell callback.

Detection Strategies

• Inspect web server and application logs for requests to the uploadH5Files endpoint, correlating source IP, authenticated user, and uploaded file metadata.
• Deploy file integrity monitoring on the EEMS web root and any directory configured as an upload target.
• Use network detection rules to flag multipart/form-data uploads carrying script content to the affected URI.

Monitoring Recommendations

• Forward EEMS application, web server, and host telemetry to a centralized analytics platform for retention and correlation.
• Alert on process execution by the web server account spawning shells, scripting interpreters, or reconnaissance utilities.
• Track authentication events for the EEMS platform and review accounts that interact with file upload endpoints.

How to Mitigate CVE-2026-7696

Immediate Actions Required

• Restrict network access to the EEMS management interface to trusted administrative networks using firewall rules or VPN gating.
• Disable or block the /SubstationWEBV2/main/uploadH5Files endpoint at the reverse proxy or web application firewall until a vendor fix is available.
• Audit existing files in EEMS upload directories and remove any artifacts that cannot be tied to legitimate operator activity.
• Rotate credentials for accounts authorized to access the EEMS platform, particularly those with upload permissions.

Patch Information

As of the last NVD update on 2026-05-05, no vendor patch has been published. The VulDB entry notes that the vendor was contacted but did not respond. Monitor VulDB Vulnerability #360865 and Acrel vendor channels for future advisories.

Workarounds

• Apply web application firewall rules that reject uploads with executable or script-bearing extensions to the affected URI.
• Configure the upload directory with a non-executable filesystem context so that any written file cannot be invoked by the web server.
• Enforce strict allow-listing of file extensions and content types at any reverse proxy fronting the EEMS application.
• Limit EEMS user accounts to the minimum privileges required and remove upload rights from accounts that do not need them.

# Example NGINX rule to block the affected upload endpoint until patched
location = /SubstationWEBV2/main/uploadH5Files {
    return 403;
}

# Example: deny execution within the upload directory
location ~* ^/SubstationWEBV2/.*\.(jsp|jspx|war|php|sh)$ {
    return 403;
}