CVE-2026-1414 | Sangfor Operation and Maintenance Security Management System HTTP POST Request get_Information getInformation command injection

A vulnerability described as critical has been identified in Sangfor Operation and Maintenance Security Management System up to 3.0.12. This impacts the function getInformation of the file /equipment/get_Information of the component HTTP POST Request Handler. Executing a manipulation of the argument fortEquipmentIp can lead to command injection.

This vulnerability is tracked as CVE-2026-1414. The attack can be launched remotely. Moreover, an exploit is present.