CVE-2026-47688 Missing authorization in fogproject
Unauthenticated attackers can remotely wipe host encryption keys and delete power schedules via public endpoints in FOGProject.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-47688?
CVE-2026-47688 is a high-severity missing authorization vulnerability in fogproject, published on 21 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to versions 1.5.10.1832 and 1.6.0-beta.2313, the `clearAES` and `clearPMTasks` methods in `FOGPage` can be invoked by an unauthenticated attacker via a single HTTP GET request through the public `client` node endpoint. This allows remote wiping of host AES encryption credentials and deletion of all power management scheduled tasks, with no login, session, or CSRF token required. Versions 1.5.10.1832 and 1.6.0-beta.2313 fix the issue.
Weakness: CWE-862
Which versions are affected by CVE-2026-47688?
It affects 1 product.
Products include Fogproject Fogproject.
How do I fix CVE-2026-47688?
No fix has been published for CVE-2026-47688 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-47688 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-47688 exists.
Other vulnerabilities in fogproject
- CVE-2025-58443 FOG's authentication bypass leads to full SQL DB dump
- CVE-2024-39914 FOG has a command injection in /fog/management/export.php?filename=
- CVE-2024-42348 FOG leaks sensitive information (AD domain, username and password)
- CVE-2024-40645 FOG Authenticated File Upload RCE
- CVE-2021-32243 File upload in n/a