A critical OS command injection vulnerability has been identified in the Sangfor Operation and Maintenance Security Management System (OMSMSS) versions up to 3.0.13. The vulnerability resides in the function com.sbr.fort.foreignDP.DpLoginController within the /fort/portal_login file at the Login Endpoint. An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary OS commands on the affected system. A public exploit has already been disclosed, increasing the risk of active exploitation. The vendor was notified prior to disclosure but did not respond, leaving users without an official patch or mitigation guidance. This vulnerability poses a significant risk to organizations using the affected Sangfor security management product, particularly as it targets the login endpoint which is typically internet-facing. Users are advised to restrict access to the system and monitor for suspicious activity until a patch is available.