PatchTheCVECVE-2026-1325: A security flaw has been discovered in Sangfor Operation and Maintenance Security Management System up to 3.0.
CVE-2026-1325 is a medium-severity flaw (CVSS 5.3) affecting operation and maintenance security management system. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
A security flaw has been discovered in Sangfor Operation and Maintenance Security Management System up to 3.0.12. This affects the function edit_pwd_mall of the file /fort/login/edit_pwd_mall. The manipulation of the argument flag results in weak password recovery. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not
Why this priority
- Public exploit reference
- Remotely exploitable, no login, no user action
A fixed release or distro patch exists.
Risk facts
| CVSS score | 5.3 (Medium) |
| Attack vector | Network (remote) |
| Attack complexity | Low |
| Privileges needed | None |
| User interaction | None |
| EPSS exploit chance | 0.6% (top 53%) |
| CISA exploited list | No |
| Weakness | CWE-640 |
| Published | 2026-01-22 |
| Last modified | 2026-06-17 |
Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2026-1325?
operation and maintenance security management system: upgrade to newer than 3.0.12. Exact commands for each OS are on this page.
Is CVE-2026-1325 being exploited?
CVE-2026-1325 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2026-1325 affect?
CVE-2026-1325 affects operation and maintenance security management system. Severity is medium (CVSS 5.3). A security flaw has been discovered in Sangfor Operation and Maintenance Security Management System up to 3.0.12. This affects the function edit_pwd_mall of the file /fort/login/edit_pwd_mall. The manipulation of the argument flag results i
How urgent is CVE-2026-1325?
Priority 40/100. Public exploit reference; Remotely exploitable, no login, no user action
Related CVEs
- CVE-2025-12916 MEDIUM 6.3 UPGRADE A vulnerability was determined in Sangfor Operation and Maintenance Security Management System 3.0
- CVE-2026-1414 MEDIUM 6.3 UPGRADE A vulnerability was determined in Sangfor Operation and Maintenance Security Management System up to 3.0.12
- CVE-2026-1413 MEDIUM 6.3 UPGRADE A vulnerability was found in Sangfor Operation and Maintenance Security Management System up to 3.0.12
- CVE-2026-1412 HIGH 7.3 UPGRADE A vulnerability has been found in Sangfor Operation and Maintenance Security Management System up to 3.0.12
- CVE-2026-1324 HIGH 8.8 UPGRADE A vulnerability was identified in Sangfor Operation and Maintenance Management System up to 3.0.12