High severity · published Jul 15, 2026
CVE-2026-15907
H3C SecPath F1000-C8300 g=log_fw_nbc_mail_jsondata sql injection
7.3
CVSS
0.4%
EPSS
No
On KEV
Description
A flaw has been found in H3C SecPath F1000-C8300 up to 20260522. This impacts an unknown function of the file /webui/?g=log_fw_nbc_mail_jsondata. Executing a manipulation of the argument subject can lead to sql injection. The attack can be executed remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure and confirmed the existence of the vulnerability. A technical fix is planned to be released.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 35% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SF
SecPath F1000-C8300 · H3C
20260522 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-15907
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-15907
ucn9h68n9289.feishu.cn
https://ucn9h68n9289.feishu.cn/docx/WCbgdWyJKoibcZxdsuMcUGKSnpf?from=from_copylink
vuldb.com
https://vuldb.com/cve/CVE-2026-15907
vuldb.com
https://vuldb.com/submit/835656
vuldb.com
https://vuldb.com/vuln/379367
vuldb.com
https://vuldb.com/vuln/379367/cti