CVE-2026-47688: FOGProject has unauthenticated clearAES and clearPMTasks that allow remote destruction of host encryption keys and power schedules
FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to versions 1.5.10.1832 and 1.6.0-beta.2313, the clearAES and clearPMTasks methods in FOGPage can be invoked by an unauthenticated attacker via a single HTTP GET request through the public client node endpoint. This allows remote wiping of host AES encryption credentials and deletion of all power management scheduled tasks, with no login, session, or CSRF token required. Versions 1.5.10.1832 and 1.6.0-beta.2313 fix the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
FOGProjectto a version that resolves this vulnerability.Fixed in 1.5.10.1832 - Upgrade
Upgrade
FOGProjectto a version that resolves this vulnerability.Fixed in 1.6.0-beta.2313
Event History
Frequently Asked Questions
What is the severity of CVE-2026-47688?
CVE-2026-47688 has a severity score of 8.2, categorized as high risk.
How do I fix CVE-2026-47688?
To fix CVE-2026-47688, upgrade to versions 1.5.10.1832 or 1.6.0-beta.2313 of FOG Project.
What does CVE-2026-47688 affect?
CVE-2026-47688 affects the FOG Project's FOGPage, specifically the clearAES and clearPMTasks methods.
Can CVE-2026-47688 be exploited remotely?
Yes, CVE-2026-47688 can be exploited remotely by an unauthenticated attacker via a single HTTP GET request.
What impact does CVE-2026-47688 have on encryption keys?
CVE-2026-47688 allows for the remote destruction of host encryption keys and power schedules.