CVE-2026-1325: Sangfor Operation and Maintenance Security Management System edit_pwd_mall password recovery
A security flaw has been discovered in Sangfor Operation and Maintenance Security Management System up to 3.0.12. This affects the function editpwdmall of the file /fort/login/editpwdmall. The manipulation of the argument flag results in weak password recovery. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-1325?
CVE-2026-1325 is considered a high severity vulnerability due to its impact on password recovery functions.
How do I fix CVE-2026-1325?
To mitigate CVE-2026-1325, update the Sangfor Operation and Maintenance Security Management System to version 3.0.12 or later.
What systems are affected by CVE-2026-1325?
CVE-2026-1325 affects the Sangfor Operation and Maintenance Security Management System up to version 3.0.12.
What potential impacts does CVE-2026-1325 have?
CVE-2026-1325 can lead to unauthorized access via the vulnerable password recovery function.
Is CVE-2026-1325 being actively exploited?
There have been reports of CVE-2026-1325 being actively exploited, making it crucial to apply mitigations immediately.