CVE-2026-1414: Sangfor Operation And Maintenance Security Management System

Critical severity, CVSS 9.8. EPSS: 4.9% chance of exploitation in the next 30 days.

A vulnerability was determined in Sangfor Operation and Maintenance Security Management System up to 3.0.12. This impacts the function getInformation of the file /equipment/get_Information of the component HTTP POST Request Handler. Executing a manipulation of the argument fortEquipmentIp can lead to command injection. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized.

Affected products

• Sangfor Operation And Maintenance Security Management System: up to and including 3.0.12

Published 2026-01-26. Last modified 2026-06-17.