What is the CVSS score of CVE-2026-47688?

CVE-2026-47688 has a CVSS 3.1 base score of 8.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L. EPSS exploitation probability: 0.2%.

Which versions of FOG Project are affected by CVE-2026-47688?

FOG Project (fogproject) contains an unauthenticated remote authorization bypass allowing any network attacker to destroy host imaging-encryption credentials and delete all scheduled power-management…. A patch is available.

How to fix or mitigate CVE-2026-47688?

Within 24 hours, inventory all FOG Project deployments and confirm running versions prior to 1.5.10.1832 (1.5.x branch) or 1.6.0-beta.2313 (1.6.x branch); verify network accessibility to the FOG web server from untrusted networks. Within 7 days, implement network segmentation to restrict access to the FOG 'client' endpoint and deploy firewall or WAF rules blocking GET requests to /clearAES and /clearPMTasks methods; enable comprehensive logging and alerting for client endpoint access attempts. Within 30 days, establish weekly automated integrity audits of imaging credentials and power-management task configurations, monitor vendor advisories for patch releases, and conduct thorough network access reviews to ensure FOG server isolation from untrusted network segments.

FOG Project CVE-2026-47688

EUVD-2026-46415 HIGH

Missing Authorization (CWE-862)

2026-07-21 GitHub_M

Authentication Bypass CSRF Fogproject

8.2

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

8.2 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L

vuln.today AI

8.2 HIGH

Pre-auth single GET over the network gives AV:N/AC:L/PR:N/UI:N; credential/task destruction is I:H, lost scheduled tasks is A:L, no data disclosure so C:N.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

Low

Lifecycle Timeline

Patch available

Jul 21, 2026 - 23:36 EUVD

Analysis Generated

Jul 21, 2026 - 21:41 vuln.today

CVE Published

Jul 21, 2026 - 20:40 cve.org

HIGH 8.2

DescriptionCVE.org

FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to versions 1.5.10.1832 and 1.6.0-beta.2313, the clearAES and clearPMTasks methods in FOGPage can be invoked by an unauthenticated attacker via a single HTTP GET request through the public client node endpoint. This allows remote wiping of host AES encryption credentials and deletion of all power management scheduled tasks, with no login, session, or CSRF token required. Versions 1.5.10.1832 and 1.6.0-beta.2313 fix the issue.

AnalysisAI

Missing authorization in FOG Project (fogproject) before 1.5.10.1832 and 1.6.0-beta.2313 lets a remote unauthenticated attacker invoke the clearAES and clearPMTasks methods of FOGPage through the public 'client' node endpoint using a single HTTP GET, wiping host AES imaging-encryption credentials and deleting all power-management scheduled tasks. No login, session, or CSRF token is required, so any attacker who can reach the FOG web server can degrade imaging integrity and disrupt scheduled operations. There is no public exploit identified at time of analysis and the flaw is not in CISA KEV, but the trivial GET-based trigger makes weaponization straightforward.

Technical ContextAI

FOG (Free Open-source Ghost) is a PHP-based network cloning, imaging, rescue, and inventory-management suite widely used by IT shops and schools to deploy operating-system images over PXE. The affected code lives in the FOGPage server-side class, whose clearAES and clearPMTasks handler methods are reachable through the unauthenticated 'client' node - an endpoint intended for FOG client agents to poll, which therefore does not enforce operator authentication. The root cause is CWE-862 (Missing Authorization): sensitive state-changing actions are exposed on a code path that performs no access-control check, so credential-clearing and task-deletion operations that should require an authenticated administrator can be driven by anonymous HTTP GET requests. Per the CPE cpe:2.3:a:fogproject:fogproject, all fogproject versions below the fixed builds are in scope.

RemediationAI

Vendor-released patch: upgrade to FOG 1.5.10.1832 (stable) or 1.6.0-beta.2313 (beta), which add the missing authorization checks; see the advisory at https://github.com/FOGProject/fogproject/security/advisories/GHSA-95pr-mcrf-x2qg for exact upgrade guidance. If immediate patching is not possible, restrict network exposure of the FOG web server: place it on a management VLAN and use firewall or web-server ACLs to allow the 'client' node endpoint only from legitimate FOG client subnets, accepting that overly tight rules may break client check-ins for imaging and power-management scheduling. A reverse proxy can also be used to block anonymous GET requests to the clearAES and clearPMTasks actions on the client endpoint, though rule mistakes risk disrupting normal client polling - validate against live client behavior. Do not expose the FOG interface directly to the internet.