CVE-2026-1325
Published: 22 January 2026
Summary
CVE-2026-1325 is a medium-severity Weak Password Recovery Mechanism for Forgotten Password (CWE-640) vulnerability in Sangfor Operation And Maintenance Security Management System. Its CVSS base score is 5.5 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 40.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and IA-5 (Authenticator Management).
Deeper analysis
CVE-2026-1325 is a security vulnerability affecting the Sangfor Operation and Maintenance Security Management System in versions up to 3.0.12. The flaw resides in the edit_pwd_mall function within the /fort/login/edit_pwd_mall file, where manipulation of the "flag" argument enables weak password recovery. It carries a CVSS v3.1 base score of 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) and is linked to CWE-640.
Unauthenticated remote attackers can exploit this vulnerability with low attack complexity and no user interaction required. Exploitation involves manipulating the specified argument to trigger weak password recovery, resulting in low integrity impact but no confidentiality or availability disruption.
Advisories from VulDB and a related GitHub issue detail the vulnerability, noting that a public exploit has been released and may be used in attacks. The vendor was contacted early for disclosure but provided no response, and no patches or official mitigations are available.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-4148
Vulnerability details
A security flaw has been discovered in Sangfor Operation and Maintenance Security Management System up to 3.0.12. This affects the function edit_pwd_mall of the file /fort/login/edit_pwd_mall. The manipulation of the argument flag results in weak password recovery. It is possible…
more
to launch the attack remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Direct unauthenticated remote exploitation of public-facing web app password recovery function (CWE-640) via argument manipulation.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires secure authenticator (password) management including reset and recovery procedures, blocking the weak recovery flaw triggered by flag manipulation.
Enforces that password-recovery actions are only performed after proper authorization, preventing unauthenticated manipulation of the edit_pwd_mall function.
Mandates re-authentication before sensitive account changes such as password recovery, mitigating bypass via the vulnerable flag argument.