CVE-2026-47688High· 8.2▾ TwilightFOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to versions 1.5.10.1832 and 1.6.0-beta.2313, the `clearAES` and `clearPMTasks` methods in `FOGPage` can be invoked by an unauthenticated attacker v…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 45.1 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Aug 7.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.2%
0.2% → 0.3%
FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to versions 1.5.10.1832 and 1.6.0-beta.2313, the clearAES and clearPMTasks methods in FOGPage can be invoked by an unauthenticated attacker via a single HTTP GET request through the public client node endpoint. This allows remote wiping of host AES encryption credentials and deletion of all power management scheduled tasks, with no login, session, or CSRF token required. Versions 1.5.10.1832 and 1.6.0-beta.2313 fix the issue.
fogproject < 1.5.10.1832Upgrade past the affected range:
fogproject 1.5.10.1832Connected by shared product, vendor, weakness, or advisory.
CVE-2026-116778High· 8.8FOG: Authenticated low-privileged API user can modify Storage Nodes and reach root command execution
CVE-2026-54554High· 7.5FOG is a free open-source cloning/imaging/rescue suite/inventory management system
CVE-2025-58443Critical· 9.1FOG is a free open-source cloning/imaging/rescue suite/inventory management system
CVE-2026-47689Medium· 4.6FOG is a free open-source cloning/imaging/rescue suite/inventory management system
CVE-2026-47687High· 7.3FOG is a free open-source cloning/imaging/rescue suite/inventory management system
CVE-2026-47685High· 7.3FOG is a free open-source cloning/imaging/rescue suite/inventory management system