CVE-2025-15499 is a high severity OS command injection (CVSS 8.8) in Sangfor Operation and Maintenance Management System up to 3.0.8. The filename argument of uploadCN in VersionController.java reaches a command unsafely. The record says an exploit is public. The vendor did not respond and no fix is confirmed.
What's affected
The record lists Sangfor Operation and Maintenance Management System up to version 3.0.8. The function is uploadCN in VersionController.java, and the manipulated input is the filename argument. The attack is network based and needs a low privilege account.
This product is an operations and maintenance gateway, the kind of system that holds credentials and access to many servers. That raises the stakes of any code execution flaw.
Two siblings were disclosed with it: CVE-2025-15502 covers a session handler and CVE-2025-15503 covers a file upload page. The record says the vendor was contacted early but did not respond, and gives no fixed version.
How to check if you're exposed
Start by finding out whether this system exists in your estate and who can reach it.
- Check your asset list for Sangfor operation and maintenance or bastion host products and their versions. The version appears in the admin interface.
- Check whether the management interface is exposed to the internet. It should not be.
- In web access logs, look for requests to the upload endpoint with unusual values in the file name, such as shell characters or long strings.
- On the host, review recent processes started by the web application user, which should be few and predictable.
If a managed service provider runs the appliance, ask them for the version and a statement of exposure.
What to do now
- Confirm whether you run Sangfor Operation and Maintenance Management System 3.0.8 or earlier.
- Remove internet exposure and allow management access only from a protected admin network.
- Limit the accounts that can sign in to the product, and remove unused ones, since the attack needs a login.
- Review the host for unexpected processes, files and outbound connections, and review credentials the system stores.
- Ask Sangfor for a patch status in writing and keep the answer.
Why it matters
The record lists CWE-78, OS Command Injection, and CWE-77, Command Injection. The application passes a value from the request, here a file name, into an operating system command. Shell syntax in that value can add commands, which then run with the permissions of the application.
The score is 8.8, driven by high impact across confidentiality, integrity and availability and a low bar of one low privilege account. It is not in CISA's Known Exploited Vulnerabilities catalog per the record. Because a system like this often stores access to other machines, a compromise can spread beyond the host.
Quick check
Why is a flaw in a maintenance system worse than in a normal app?
These systems hold access paths and often credentials for many servers. Code execution on one can reach all of them.
Is there a patch?
None is confirmed. The record says the vendor did not respond. Restrict network access and monitor the host.
Sources
Last reviewed: 19 October 2026.
