CVE-2026-1325
Published: 22 January 2026
Summary
CVE-2026-1325 is a medium-severity Weak Password Recovery Mechanism for Forgotten Password (CWE-640) vulnerability in Sangfor Operation And Maintenance Security Management System. Its CVSS base score is 5.3 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 17.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Threat & Defense at a Glance
Threat & Defense Details
Likely Mitigating ControlsAI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Establishing procedures for lost or compromised authenticators addresses weak password recovery mechanisms.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Direct unauthenticated remote exploitation of public-facing web app password recovery function (CWE-640) via argument manipulation.
NVD Description
A security flaw has been discovered in Sangfor Operation and Maintenance Security Management System up to 3.0.12. This affects the function edit_pwd_mall of the file /fort/login/edit_pwd_mall. The manipulation of the argument flag results in weak password recovery. It is possible…
more
to launch the attack remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Deeper analysisAI
CVE-2026-1325 is a security vulnerability affecting the Sangfor Operation and Maintenance Security Management System in versions up to 3.0.12. The flaw resides in the edit_pwd_mall function within the /fort/login/edit_pwd_mall file, where manipulation of the "flag" argument enables weak password recovery. It carries a CVSS v3.1 base score of 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) and is linked to CWE-640.
Unauthenticated remote attackers can exploit this vulnerability with low attack complexity and no user interaction required. Exploitation involves manipulating the specified argument to trigger weak password recovery, resulting in low integrity impact but no confidentiality or availability disruption.
Advisories from VulDB and a related GitHub issue detail the vulnerability, noting that a public exploit has been released and may be used in attacks. The vendor was contacted early for disclosure but provided no response, and no patches or official mitigations are available.
Details
- CWE(s)