What is the CVSS score of CVE-2026-1325?

CVE-2026-1325 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.1%.

Is there a public PoC exploit available for CVE-2026-1325?

Yes, a public proof-of-concept exploit is available for CVE-2026-1325. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2026-1325?

Within 30 days: Identify affected systems running Sangfor Operation and Maintenance Security Management System and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

Operation And Maintenance Security Management System CVE-2026-1325

Q: Which versions of Operation And Maintenance Security Management System are affected by CVE-2026-1325?

Organizations using Sangfor Operation and Maintenance Security Management System should be aware of moderate risk from CVE-2026-1325 rated CVSS 5.3.

MEDIUM

Weak Password Recovery Mechanism for Forgotten Password (CWE-640)

2026-01-22 cna@vuldb.com

Information Disclosure Operation And Maintenance Security Management System Sangfor

5.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:54 vuln.today

PoC Detected

Jan 30, 2026 - 16:37 vuln.today

Public exploit code

CVE Published

Jan 22, 2026 - 15:16 nvd

MEDIUM 5.3

DescriptionCVE.org

A security flaw has been discovered in Sangfor Operation and Maintenance Security Management System up to 3.0.12. This affects the function edit_pwd_mall of the file /fort/login/edit_pwd_mall. The manipulation of the argument flag results in weak password recovery. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

Operation And Maintenance Security Management System versions up to 3.0.12. is affected by weak password recovery mechanism for forgotten password (CVSS 5.3).

Technical ContextAI

This vulnerability (CWE-640: Weak Password Recovery Mechanism for Forgotten Password) affects Operation And Maintenance Security Management System. A security flaw has been discovered in Sangfor Operation and Maintenance Security Management System up to 3.0.12. This affects the function edit_pwd_mall of the file /fort/login/edit_pwd_mall. The manipulation of the argument flag results in weak password recovery. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.