CVE-2026-18641 | Sangfor Operation and Maintenance Security Management System Login Endpoint /fort/portal_login com.sbr.fort.foreignDP.DpLoginController os command injection

A vulnerability, which was classified as critical, has been found in Sangfor Operation and Maintenance Security Management System up to 3.0.13. Affected by this vulnerability is the function com.sbr.fort.foreignDP.DpLoginController of the file /fort/portal_login of the component Login Endpoint. This manipulation causes os command injection.

This vulnerability is handled as CVE-2026-18641. The attack can be initiated remotely. Additionally, an exploit exists.

The vendor was contacted early about this disclosure but did not respond in any way.