VYPR
← All advisories
High severity8.2NVD Advisory· Published Jul 21, 2026· Updated Aug 7, 2026

CVE-2026-47688

CVE-2026-47688

Description

FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to versions 1.5.10.1832 and 1.6.0-beta.2313, the clearAES and clearPMTasks methods in FOGPage can be invoked by an unauthenticated attacker via a single HTTP GET request through the public client node endpoint. This allows remote wiping of host AES encryption credentials and deletion of all power management scheduled tasks, with no login, session, or CSRF token required. Versions 1.5.10.1832 and 1.6.0-beta.2313 fix the issue.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

3
  • Fogproject/Fogproject2 versions
    cpe:2.3:a:fogproject:fogproject:*:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:a:fogproject:fogproject:*:*:*:*:*:*:*:*range: <1.5.10.1832
    • (no CPE)range: <1.5.10.1832, <1.6.0-beta.2313
  • Fogproject/Fogllm-fuzzy
    Range: <1.5.10.1832, <1.6.0-beta.2313

Patches

Vulnerability mechanics

References

1

News mentions

0

No linked articles in our index yet.