High severity · published Jul 21, 2026
CVE-2026-47688
FOGProject has unauthenticated clearAES and clearPMTasks that allow remote destruction of host encryption keys and power schedules
8.2
CVSS
0.3%
EPSS
No
On KEV
Description
FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to versions 1.5.10.1832 and 1.6.0-beta.2313, the `clearAES` and `clearPMTasks` methods in `FOGPage` can be invoked by an unauthenticated attacker via a single HTTP GET request through the public `client` node endpoint. This allows remote wiping of host AES encryption credentials and deletion of all power management scheduled tasks, with no login, session, or CSRF token required. Versions 1.5.10.1832 and 1.6.0-beta.2313 fix the issue.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
High
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 19% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
FO
fogproject · FOGProject
< 1.5.10.1832; < 1.6.0-beta.2313 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-47688
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-47688
Exploit
https://github.com/FOGProject/fogproject/security/advisories/GHSA-95pr-mcrf-x2qg
More from fogproject
9.8
CVE-2024-39914
FOG has a command injection in /fog/management/export.php?filename=
9.1
CVE-2025-58443
FOG's authentication bypass leads to full SQL DB dump
8.8
CVE-2026-116778
FOG: Authenticated low-privileged API user can modify Storage Nodes and reach root command execution
8.8
CVE-2024-40645
FOG Authenticated File Upload RCE
8.8
CVE-2021-32243
FOGProject v1.5.9 is affected by a File Upload RCE (Authenticated)