CVE-2026-47688
FOGProject has unauthenticated clearAES and clearPMTasks that allow remote destruction of host encryption keys and power schedules
CVSS Score
8.2
EPSS Score
0.0%
EPSS Percentile
0th
FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to versions 1.5.10.1832 and 1.6.0-beta.2313, the `clearAES` and `clearPMTasks` methods in `FOGPage` can be invoked by an unauthenticated attacker via a single HTTP GET request through the public `client` node endpoint. This allows remote wiping of host AES encryption credentials and deletion of all power management scheduled tasks, with no login, session, or CSRF token required. Versions 1.5.10.1832 and 1.6.0-beta.2313 fix the issue.
| CWE | CWE-862 |
| Vendor | fogproject |
| Product | fogproject |
| Published | Jul 21, 2026 |
Stay Ahead of the Next One
Get instant alerts for fogproject fogproject
Be the first to know when new high vulnerabilities affecting fogproject fogproject are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
High
Availability
Low
Affected Versions
FOGProject / fogproject
< 1.5.10.1832 < 1.6.0-beta.2313