Remote Code Execution Vulnerability in FOG Management System
CVE-2026-54554

7.5HIGH

Key Information:

Vendor: Fogproject
Status: Fogproject
Vendor: CVE Published:; 14 October 2026

What is CVE-2026-54554?

The FOG Management System, an open-source cloning and inventory management tool, has a vulnerability in the management adInfo() endpoint. This endpoint can potentially expose the default domain-join credentials via the domainpass JSON field without requiring an authenticated session. The leaked credentials might allow an unauthenticated remote user to access sensitive information. This issue affects versions prior to 1.5.10.1870 and has been addressed in the latest release.