CVE-2026-18641 - Sangfor Operation and Maintenance Security Management System Login Endpoint portal_login com.sbr.fort.foreignDP.DpLoginController os command injection

Back Back to CVE browser

MEDIUM

Sangfor Operation and Maintenance Security Management System Login Endpoint portal_login com.sbr.fort.foreignDP.DpLoginController os command injection

Published Aug 3, 2026

6.9

MEDIUM

CVSS 4.0

EPSS 2.66%

Description

A vulnerability was determined in Sangfor Operation and Maintenance Security Management System up to 3.0.13. Affected by this vulnerability is the function com.sbr.fort.foreignDP.DpLoginController of the file /fort/portal_login of the component Login Endpoint. This manipulation causes os command injection. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

Affected products

Vendor Sangfor Product Operation and Maintenance Security Management System Default
unknown
Affected
- 3.0.0
- 3.0.1
- 3.0.10
- 3.0.11
- 3.0.12
- 3.0.13
- 3.0.2
- 3.0.3
- 3.0.4
- 3.0.5
- 3.0.6
- 3.0.7
- 3.0.8
- 3.0.9

Default status is the baseline for the product. Each version can override it (patched versions can be marked unaffected).

Vendor	Product	Default status	Versions
Sangfor	Operation and Maintenance Security Management System	unknown	Affected 3.0.0 3.0.1 3.0.10 3.0.11 3.0.12 3.0.13 3.0.2 3.0.3 3.0.4 3.0.5 3.0.6 3.0.7 3.0.8 3.0.9

Remediation

No remediation recorded yet.

Weaknesses (2)

CWE-77

CWE-78

OS Command Injection

References (6)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-52416
Advisory
https://github.com/lkua-1/cve/issues/1
exploitissue-tracking
https://vuldb.com/cve/CVE-2026-18641
third-party-advisory
https://vuldb.com/submit/853189
third-party-advisory
https://vuldb.com/vuln/385562
vdb-entrytechnical-description
https://vuldb.com/vuln/385562/cti
signaturepermissions-required

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-52416		Advisory
https://github.com/lkua-1/cve/issues/1		exploitissue-tracking
https://vuldb.com/cve/CVE-2026-18641		third-party-advisory
https://vuldb.com/submit/853189		third-party-advisory
https://vuldb.com/vuln/385562		vdb-entrytechnical-description
https://vuldb.com/vuln/385562/cti		signaturepermissions-required

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner VulDB

Published Aug 3, 2026

Updated Aug 5, 2026

Reserved Aug 3, 2026

Link CVE-2026-18641

CISA Vulnrichment

Updated Aug 5, 2026

NVD

Status Deferred

Modified Aug 12, 2026

Link CVE-2026-18641

Red Hat

No data

ENISA EUVD

Assigner VulDB

Published Aug 3, 2026

Updated Aug 5, 2026

Link EUVD-2026-52416

GitHub

No data