FOG Project CVE-2026-47688

Exploitation requires only network reachability to the FOG server's public 'client' node endpoint and the ability to send an HTTP GET invoking the clearAES or clearPMTasks FOGPage methods - no login, session cookie, or CSRF token is needed (consistent with AV:N/AC:L/PR:N/UI:N). The primary limiting factor is network exposure: the FOG web server must be reachable by the attacker, so deployments confined to an isolated, firewalled imaging VLAN are far harder to reach than internet-exposed or flat-network installs. Only versions below 1.5.10.1832 / 1.6.0-beta.2313 are vulnerable, so patched instances are not exploitable; there is no user-interaction or non-default-configuration requirement, and the 'client' endpoint being unauthenticated is the default design that this flaw abuses.

The CVSS 3.1 base score is 8.2 (High) with vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L, reflecting network reach, low complexity, no privileges, and no user interaction - an attractive exploitation profile because the only barrier is network access to the FOG server. Impact is scoped to integrity (I:H, credential/task destruction) and low availability (A:L, loss of scheduled power-management jobs), with no confidentiality impact (C:N), so this is a sabotage/disruption issue rather than a data-theft or RCE issue. No EPSS score was provided and the CVE is not in CISA KEV, and no POC was referenced, so real-world exploitation is currently unproven despite the low technical bar; the SSVC 'automatable' potential is high given the single-GET trigger. Bottom line: a genuine priority for internet-exposed or shared-LAN FOG servers because exploitation is trivial and pre-auth, but the bounded (integrity/availability only) impact means it ranks below RCE-class flaws - patch promptly, especially where the FOG web interface is broadly reachable.

An attacker with network access to the FOG server - for example a device on the same imaging LAN or an internet-reachable deployment - sends a single crafted HTTP GET to the public 'client' node invoking clearAES, wiping stored host AES encryption credentials so subsequent encrypted imaging operations fail or must be re-provisioned. The same actor then calls clearPMTasks to delete all scheduled power-management tasks, disrupting automated shutdown/wake cycles; because no authentication, session, or CSRF token is needed, the requests can be scripted and repeated at will, and no public exploit is currently required to reproduce it.