PatchTheCEVCVE-2026-18641: A vulnerability was determined in Sangfor Operation and Maintenance Security Management System up to 3.0.13
CVE-2026-18641 is a high-severity flaw (CVSS 7.3) affecting affected software. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
A vulnerability was determined in Sangfor Operation and Maintenance Security Management System up to 3.0.13. Affected by this vulnerability is the function com.sbr.fort.foreignDP.DpLoginController of the file /fort/portal_login of the component Login Endpoint. This manipulation causes os command injection. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this d
Why this priority
- High severity
- CISA SSVC: public proof of concept
- Remotely exploitable, no login, no user action
A fixed release or distro patch exists.
Timeline
- Published CVE record published
- Updated Record last modified
Exact fixes by distribution
Public exploits and detection
Public code exists for this CVE. Treat unpatched systems as at risk, and only run PoCs in a lab.
- Write-up: github.com/lkua-1/cve/issues/1
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.