OS Command Injection Vulnerability in Sangfor Operation and Maintenance Security Management System
CVE-2026-18641

6.9MEDIUM

Key Information:

Vendor: Sangfor
Status: Operation And Maintenance Security Management System
Vendor: CVE Published:; 3 August 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-18641?

The Sangfor Operation and Maintenance Security Management System up to version 3.0.13 contains a vulnerability in the Login Endpoint, specifically in the com.sbr.fort.foreignDP.DpLoginController function. This vulnerability allows for remote attackers to perform OS command injection through manipulated input, which can lead to unauthorized execution of commands on the server. Despite prior notification to the vendor about the issue, no response has been received, raising concerns about the security of the affected components.

Affected Version(s)

Operation and Maintenance Security Management System 3.0.0

Operation and Maintenance Security Management System 3.0.1

Operation and Maintenance Security Management System 3.0.2

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-18641 - Proof of Concept