CVE-2026-1324 is a high severity flaw (CVSS 8.8) in Sangfor Operation and Maintenance Management System up to 3.0.12. The keypassword argument in the SSH protocol handler leads to OS command injection. The vendor did not respond to the researcher, so no fixed version is confirmed. Restrict access now.
What's affected
The record says versions up to 3.0.12 are affected. The affected code is the SessionController function behind the /isomp-protocol/protocol/session path, in the SSH protocol handler component.
The record states that the vendor was contacted early and did not respond. We found no vendor advisory or fixed version, so none is named here. Ask Sangfor for guidance on your deployment.
How to check if you're exposed
Look at the version shown in the admin interface of your Sangfor operation and maintenance security system. If it is 3.0.12 or older, treat it as affected.
If the system fronts privileged access to servers, check who can reach its web interface. The record says the attack can start remotely, and that it needs a low privilege account, so your user list and network exposure both matter.
What to do now
- Confirm the product version and whether the management interface is reachable from untrusted networks.
- Limit access to the interface to a small admin network or VPN.
- Review accounts and remove any you do not need, since the attack needs a login.
- Contact Sangfor for a fixed build or a mitigation and keep the reply on file.
- Watch the host for unexpected child processes and outbound connections from the application.
Why it matters
Command injection happens when input reaches a shell or system call without being separated from the command. The record names a single parameter in the session handler as the entry point. The score is high because a successful attack gives the attacker command execution on a system that often holds keys and sessions for other servers.
The record says an exploit has been published, and that it might be used. That is not the same as confirmed use against real victims, and the record does not flag this CVE as known exploited.
The record lists these weakness classes: CWE-77 (Command Injection), CWE-78 (OS Command Injection).
Quick check
Is there a patch?
We could not confirm one. The record says the vendor did not respond to the disclosure, so get guidance from Sangfor directly.
Sources
Last reviewed: 19 October 2026.
