# CVE-2026-15907: H3C SecPath F1000-C8300 SQL injection in log_fw_nbc_mail_jsondata

Source: https://junglewise.ai/threats/cve-2026-15907-h3c-secpath-f1000-c8300-sql-injection-in-log-fw-nbc-mail-jsondata  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-16. Updated: 2026-07-16  
License: CC BY 4.0 with a link back

CVE-2026-15907 · Severity: high · CVSS 7.3 · Published 2026-07-16

H3C SecPath firewalls are used to protect enterprise networks by monitoring and filtering incoming and outgoing traffic. A security flaw has been identified that could allow an unauthorized person to remotely access or manipulate the device's internal database. This could lead to the exposure of sensitive logs or configuration data, potentially compromising the security of the entire network.

Vendors: [H3C](https://junglewise.ai/threats/vendors/h3c).

## Quick answers

**Is CVE-2026-15907 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-15907 being exploited in the wild.

**How severe is CVE-2026-15907?** High severity, with a CVSS score of 7.3, published 16 July 2026.

**Which products and versions are affected?** H3C SecPath F1000-C8300 up to 20260522.

**Is there a fix for CVE-2026-15907?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-15907 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-15907?** Check whether you run H3C SecPath F1000-C8300 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A SQL injection vulnerability (CWE-89) exists in the H3C SecPath F1000-C8300 firewall up to version 20260522. The flaw is located within the web management interface, specifically in the '/webui/?g=log_fw_nbc_mail_jsondata' component. An attacker can exploit this by manipulating the 'subject' parameter in a remote request. Successful exploitation allows for unauthorized database queries, which can lead to data exfiltration or modification. The vendor has confirmed the vulnerability and a fix is reportedly planned.

## Affected products

- H3C SecPath F1000-C8300 up to 20260522

## Timeline

- 2026-07-16: advisory: NVD publication date
- 2026-07-16: disclosed: Public disclosure of the vulnerability and exploit

## References

- [https://ucn9h68n9289.feishu.cn/docx/WCbgdWyJKoibcZxdsuMcUGKSnpf?from=from_copylink](https://ucn9h68n9289.feishu.cn/docx/WCbgdWyJKoibcZxdsuMcUGKSnpf?from=from_copylink)
- [https://vuldb.com/cve/CVE-2026-15907](https://vuldb.com/cve/CVE-2026-15907)
- [https://vuldb.com/submit/835656](https://vuldb.com/submit/835656)
- [https://vuldb.com/vuln/379367](https://vuldb.com/vuln/379367)
- [https://vuldb.com/vuln/379367/cti](https://vuldb.com/vuln/379367/cti)