CVE-2026-47688
Last modified
CVE-2026-47688 is a high-severity vulnerability rated 8.2/10 on the CVSS scale. FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to versions 1.5.10.1832 and 1.6.0-beta.2313, the `clearAES` and `clearPMTasks` methods in `FOGPage` can be invoked by an unauthenticated attacker via a single HTTP GET request through the public `client` node endpoint. EPSS estimates a 0.15% chance of exploitation in the next 30 days.
Description
FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to versions 1.5.10.1832 and 1.6.0-beta.2313, the `clearAES` and `clearPMTasks` methods in `FOGPage` can be invoked by an unauthenticated attacker via a single HTTP GET request through the public `client` node endpoint. This allows remote wiping of host AES encryption credentials and deletion of all power management scheduled tasks, with no login, session, or CSRF token required. Versions 1.5.10.1832 and 1.6.0-beta.2313 fix the issue.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Fogproject | Fogproject | < 1.5.10.1832 |
References
- https://github.com/FOGProject/fogproject/security/advisories/GHSA-95pr-mcrf-x2qgExploit, Vendor Advisory
- https://github.com/FOGProject/fogproject/security/advisories/GHSA-95pr-mcrf-x2qgExploit, Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2026-47688?
How severe is CVE-2026-47688?
How do I fix CVE-2026-47688?
How Strix Helps
- Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-47675Hono is a Web application framework that provides support fo…5.3
- CVE-2026-47676Hono is a Web application framework that provides support fo…5.3
- CVE-2026-47682CVAT is an open source interactive video and image annotatio…7.1
- CVE-2026-47684Sync-in Server is a secure, open-source platform for file st…7.7
- CVE-2026-47685FOG is a free open-source cloning/imaging/rescue suite/inven…8.7
- CVE-2026-47687FOG is a free open-source cloning/imaging/rescue suite/inven…8.7
- CVE-2026-47689FOG is a free open-source cloning/imaging/rescue suite/inven…5.2
- CVE-2026-4769Certain devices in the WAGO System I/O Field series activate…9.8
- CVE-2026-47690MeltanoHub is the source code for hub.meltano.com, the centr…7.5
- CVE-2026-47691Netty is a network application framework for development of …10
- CVE-2026-47692Envoy is an open source edge and service proxy designed for …4.3
- CVE-2026-47693Poweradmin is a web-based DNS administration tool for PowerD…6.9
Are you affected by CVE-2026-47688?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST