Is CVE-2026-54554 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-54554 being exploited in the wild.

How severe is CVE-2026-54554?

High severity, with a CVSS score of 7.5, published 14 October 2026.

Which products and versions are affected?

FOG Project FOG before 1.5.10.1870.

Is there a fix for CVE-2026-54554?

Yes: fixed in 1.5.10.1870. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-54554 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-54554?

Check whether you run FOG Project FOG at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-54554: FOG Project unauthenticated default password disclosure

CVE-2026-54554 · Severity: high · CVSS 7.5 · Published 2026-10-14

FOG is an open-source system for device cloning, imaging, and inventory management. Prior to version 1.5.10.1870, the administrative iPXE management interface did not require authentication and exposed the default Active Directory join password to anyone accessing it over the network. An attacker with network access could obtain this credential without logging in, potentially compromising domain-joined systems.

Vendors: FOG Project.

Quick answers

Is CVE-2026-54554 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-54554 being exploited in the wild.
How severe is CVE-2026-54554?: High severity, with a CVSS score of 7.5, published 14 October 2026.
Which products and versions are affected?: FOG Project FOG before 1.5.10.1870.
Is there a fix for CVE-2026-54554?: Yes: fixed in 1.5.10.1870. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-54554 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-54554?: Check whether you run FOG Project FOG at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 1.5.10.1870

Technical details

The adInfo() endpoint in fogpage.class.php returned the FOG_AD_DEFAULT_PASSWORD value in the domainpass JSON field and was accessible via node=ipxe without an authenticated session due to improper allowlist configuration. The management and iPXE interfaces both had inconsistent authentication gates. An unauthenticated network attacker could directly retrieve the domain-join credential used by the Active Directory configuration, affecting all hosts configured through this interface.

Affected products

FOG Project FOG before 1.5.10.1870

Timeline

2026-10-14: disclosed
2026-10-14: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.