CVE-2026-1325CRITICAL 9.8EPSS p40.1%

CVE-2026-1325CVE-2026-1325

Description

A security flaw has been discovered in Sangfor Operation and Maintenance Security Management System up to 3.0.12. This affects the function edit_pwd_mall of the file /fort/login/edit_pwd_mall. The manipulation of the argument flag results in weak password recovery. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

Scoring

CVSS 3.19.8 (CRITICAL)
VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS0.52% probability of exploitation · percentile 40.1% · 2026-06-19T12:03:05Z
Published2026-01-22
Last modified2026-01-30

Underlying weaknesses· 1

CWE-640

References

  1. https://github.com/LX-LX88/cve/issues/21
  2. https://vuldb.com/?ctiid.342301
  3. https://vuldb.com/?id.342301
  4. https://vuldb.com/?submit.736208

1

TypeTargetConfidenceTier
WeaknessWeak Password Recovery Mechanism for Forgotten Passwordcwe-6400%live

Related by meaning· 6

Nearest entities by semantic similarity across the cs-graph corpus.

CVE
CVE-2025-12916
CVE
CVE-2026-1413
CVE
CVE-2026-1324
CVE
CVE-2026-1414
CVE
CVE-2026-1412
CVE
CVE-2025-15503
Sourced from NVD + FIRST.org EPSS. Curated for EU compliance use cases by Adam Lundqvist, Founder at SQUR.