What is the CVSS score of CVE-2026-47688?

CVE-2026-47688 has a CVSS 3.1 base score of 8.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L. EPSS exploitation probability: 0.2%.

Which versions of FOG Project are affected by CVE-2026-47688?

FOG Project (fogproject) contains an unauthenticated remote authorization bypass allowing any network attacker to destroy host imaging-encryption credentials and delete all scheduled power-management…. A patch is available.

How to fix or mitigate CVE-2026-47688?

Within 24 hours, inventory all FOG Project deployments and confirm running versions prior to 1.5.10.1832 (1.5.x branch) or 1.6.0-beta.2313 (1.6.x branch); verify network accessibility to the FOG web server from untrusted networks. Within 7 days, implement network segmentation to restrict access to the FOG 'client' endpoint and deploy firewall or WAF rules blocking GET requests to /clearAES and /clearPMTasks methods; enable comprehensive logging and alerting for client endpoint access attempts. Within 30 days, establish weekly automated integrity audits of imaging credentials and power-management task configurations, monitor vendor advisories for patch releases, and conduct thorough network access reviews to ensure FOG server isolation from untrusted network segments.

FOG Project CVE-2026-47688

EUVD-2026-46415 HIGH

Missing Authorization (CWE-862)

2026-07-21 GitHub_M

Authentication Bypass CSRF Fogproject

8.2

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

8.2 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L

vuln.today AI

8.2 HIGH

Pre-auth single GET over the network gives AV:N/AC:L/PR:N/UI:N; credential/task destruction is I:H, lost scheduled tasks is A:L, no data disclosure so C:N.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

Low

Lifecycle Timeline

Patch available

Jul 21, 2026 - 23:36 EUVD

Analysis Generated

Jul 21, 2026 - 21:41 vuln.today

CVE Published

Jul 21, 2026 - 20:40 cve.org

HIGH 8.2

DescriptionCVE.org

FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to versions 1.5.10.1832 and 1.6.0-beta.2313, the clearAES and clearPMTasks methods in FOGPage can be invoked by an unauthenticated attacker via a single HTTP GET request through the public client node endpoint. This allows remote wiping of host AES encryption credentials and deletion of all power management scheduled tasks, with no login, session, or CSRF token required. Versions 1.5.10.1832 and 1.6.0-beta.2313 fix the issue.

AnalysisAI

Missing authorization in FOG Project (fogproject) before 1.5.10.1832 and 1.6.0-beta.2313 lets a remote unauthenticated attacker invoke the clearAES and clearPMTasks methods of FOGPage through the public 'client' node endpoint using a single HTTP GET, wiping host AES imaging-encryption credentials and deleting all power-management scheduled tasks. No login, session, or CSRF token is required, so any attacker who can reach the FOG web server can degrade imaging integrity and disrupt scheduled operations. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Reach FOG web server over network

Delivery

Send crafted GET to public client node

Exploit

Invoke clearAES without authentication

Execution

Wipe host AES credentials

Persist

Invoke clearPMTasks

Impact

Delete all power-management tasks

Access

Reach FOG web server over network

Delivery

Send crafted GET to public client node

Exploit

Invoke clearAES without authentication

Execution

Wipe host AES credentials

Persist

Invoke clearPMTasks

Impact

Delete all power-management tasks

Vulnerability AssessmentAI

Exploitation	Exploitation requires only network reachability to the FOG server's public 'client' node endpoint and the ability to send an HTTP GET invoking the clearAES or clearPMTasks FOGPage methods - no login, session cookie, or CSRF token is needed (consistent with AV:N/AC:L/PR:N/UI:N). … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 3.1 base score is 8.2 (High) with vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L, reflecting network reach, low complexity, no privileges, and no user interaction - an attractive exploitation profile because the only barrier is network access to the FOG server. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An attacker with network access to the FOG server - for example a device on the same imaging LAN or an internet-reachable deployment - sends a single crafted HTTP GET to the public 'client' node invoking clearAES, wiping stored host AES encryption credentials so subsequent encrypted imaging operations fail or must be re-provisioned. The same actor then calls clearPMTasks to delete all scheduled power-management tasks, disrupting automated shutdown/wake cycles; because no authentication, session, or CSRF token is needed, the requests can be scripted and repeated at will, and no public exploit is currently required to reproduce it.
Remediation	Vendor-released patch: upgrade to FOG 1.5.10.1832 (stable) or 1.6.0-beta.2313 (beta), which add the missing authorization checks; see the advisory at https://github.com/FOGProject/fogproject/security/advisories/GHSA-95pr-mcrf-x2qg for exact upgrade guidance. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours, inventory all FOG Project deployments and confirm running versions prior to 1.5.10.1832 (1.5.x branch) or 1.6.0-beta.2313 (1.6.x branch); verify network accessibility to the FOG web server from untrusted networks. …

Threat intelligence, references, and detailed analysis are available after sign-in.