Is CVE-2026-116778 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-116778 being exploited in the wild.

How severe is CVE-2026-116778?

High severity, with a CVSS score of 8.8, published 28 October 2026.

Which products and versions are affected?

FOG Project FOG before 1.5.10.2253 and before 1.6.0-RC-1.

How is CVE-2026-116778 attacked?

It is attacked over the network.

Am I affected by CVE-2026-116778?

Check whether you run FOG Project FOG at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-116778: FOG Project cloning suite command injection via Storage Node API

CVE-2026-116778 · Severity: high · CVSS 8.8 · Published 2026-10-28

FOG is an open-source system for cloning, imaging, and managing computers across a network. An authenticated user with low-privilege API access can exploit insufficient permission checks to modify storage node configuration and inject arbitrary commands into the replication service, which runs with root privileges. This allows the attacker to execute commands as root and potentially compromise the entire imaging infrastructure.

Vendors: FOG Project.

Quick answers

Is CVE-2026-116778 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-116778 being exploited in the wild.
How severe is CVE-2026-116778?: High severity, with a CVSS score of 8.8, published 28 October 2026.
Which products and versions are affected?: FOG Project FOG before 1.5.10.2253 and before 1.6.0-RC-1.
Is there a fix for CVE-2026-116778?: Yes: fixed in 1.5.10.2253, 1.6.0-RC-1. Until then: Restrict API access to trusted administrators only; disable storage replication if not required; ensure the FOG service runs with the minimum necessary privileges (not root if possible). Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-116778 attacked?: It is attacked over the network.
Am I affected by CVE-2026-116778?: Check whether you run FOG Project FOG at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 1.5.10.2253, 1.6.0-RC-1

Restrict API access to trusted administrators only; disable storage replication if not required; ensure the FOG service runs with the minimum necessary privileges (not root if possible).

Technical details

The vulnerability combines missing authorization (CWE-862) and command injection (CWE-78). The API endpoint PUT /fog/storagenode/{id}/edit fails to enforce administrator-only access, allowing any API-enabled user (including uType=1 low-privilege accounts) to modify storage node credentials and paths. These unsanitized values are then interpolated into an lftp command executed via proc_open() by the root-running FOGImageReplicator service, allowing arbitrary command execution as root.

Affected products

FOG Project FOG before 1.5.10.2253 and before 1.6.0-RC-1

Timeline

2026-10-28: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.