CVE-2026-1325 is a medium severity flaw (CVSS 5.3) in Sangfor Operation and Maintenance Security Management System up to 3.0.12. The edit_pwd_mall function mishandles the flag argument, which weakens password recovery. The vendor did not respond to the disclosure, so restrict access and ask Sangfor for a fix.
What's affected
The record says versions up to 3.0.12 are affected. The affected path is /fort/login/edit_pwd_mall, in the function edit_pwd_mall, and the argument involved is named flag.
The record says the vendor was contacted early and did not respond. We found no fixed version, so none is stated here.
How to check if you're exposed
Check the product version in the admin console. If it is 3.0.12 or older, assume it is affected. Then check whether the login and password pages are reachable from the internet or from broad internal networks. The record says the attack can be launched remotely without a prior login.
Review password change events for accounts that you did not expect to change.
What to do now
- Confirm your version and where the login page is reachable from.
- Put the interface behind a VPN or an allowlist of admin addresses.
- Review recent password changes and force a reset for any account you doubt.
- Ask Sangfor for a fixed version and record the answer.
- Enable alerts on password change and failed login events if the product supports it.
Why it matters
Password recovery paths are a common weak point because they are another way to prove identity. The record classes this as weak password recovery for forgotten passwords. The integrity impact is rated low and confidentiality and availability none, which is why the score is only medium.
Still, this product manages privileged access, so even a limited account change deserves a look. The record says the exploit was released to the public, which is a reason to move quickly on exposure. It does not flag the CVE as known exploited.
The record lists this weakness class: CWE-640 (Weak Password Recovery Mechanism for Forgotten Password).
Quick check
Why is the score only 5.3?
The vector rates the impact as a low integrity change and none for confidentiality and availability. Context matters more than the number, because this system guards privileged access.
Sources
Last reviewed: 19 October 2026.
