CVE-2026-1414 is a medium severity command injection (CVSS 6.3) in the Sangfor Operation and Maintenance Security Management System up to 3.0.12. The fortEquipmentIp argument of getInformation reaches a command. A low privilege login is needed. The vendor did not respond, so restrict access and ask for a fix.
What's affected
The record says versions up to 3.0.12 of the Sangfor Operation and Maintenance Security Management System are affected. The affected function is getInformation at /equipment/get_Information, in the HTTP POST request handler, and the argument involved is fortEquipmentIp.
The record states that the vendor was contacted early and did not respond. We found no vendor advisory or fixed version, so none is named here. Ask Sangfor for guidance on your deployment.
How to check if you're exposed
Check the version shown in the admin interface. If it is 3.0.12 or older, treat it as affected. Then check where the web interface is reachable from, since the record says the attack can start remotely.
Look in the web server and application logs for unusual requests to the path named above, and watch the host for unexpected child processes.
What to do now
- Confirm the version and where the management interface is reachable from.
- Restrict access to a small admin network or VPN.
- Review accounts and remove ones that are not needed, since a login is required.
- Ask Sangfor for a fixed build or mitigation and keep the reply on file.
- Watch the host for unexpected processes and outbound connections.
Why it matters
The record lists CWE-74 and CWE-77, injection and command injection. An argument that names an equipment address is passed on without being kept apart from the command, according to the description.
The vector needs a low privilege account and rates each impact low. As with the other Sangfor records in this series, that is a reason to review accounts and network exposure, not a reason to wait. The record says the exploit has been publicly disclosed and may be used. It does not flag the CVE as known exploited.
The record lists these weakness classes: CWE-74 (Injection), CWE-77 (Command Injection).
Quick check
Is this the same flaw as CVE-2026-1413?
No. It is a separate record with a different function, path and argument, though the product and the vulnerability class are the same.
Sources
Last reviewed: 19 October 2026.
