CVE-2026-54554 FOGProject CVE debrief

Who should care

Defenders responsible for FOG project deployments, particularly those using Active Directory integration, should assess exposure and verify their versions. This includes reviewing and restricting access to the adInfo endpoint, monitoring for unauthorized access to Active Directory join credentials, and tracking exceptions and remediation efforts.

Why it matters

CVE-2026-54554 is a high-severity vulnerability in the FOG project that discloses Active Directory join passwords. Defenders responsible for FOG deployments, especially those using Active Directory integration, should verify their versions and update to 1.5.10.1870 or later to mitigate potential unauthorized disclosure of credentials and elevation of privileges.

• Potential unauthorized disclosure of Active Directory join credentials
• Possible elevation of privileges through access to Active Directory configuration interfaces
• Required verification of FOG project version and potential updates to 1.5.10.1870 or later
• Potential impact on incident response and remediation efforts due to credential exposure

Technical summary

The FOG adInfo endpoint, prior to version 1.5.10.1870, discloses the Active Directory join password in its domainpass JSON field. This endpoint is dispatchable through node=ipxe without an authenticated session, and its response is consumed by host and group Active Directory configuration interfaces. The vulnerability has a CVSS score of 7.5 and is considered HIGH severity. The issue is fixed in FOG version 1.5.10.1870. Defenders should prioritize verifying FOG project versions and updating to 1.5.10.1870 or later.

Defensive priority

Defenders should prioritize verifying FOG project versions and updating to 1.5.10.1870 or later.

Recommended defensive actions

• Verify FOG project version and update to 1.5.10.1870 or later
• Review and restrict access to the adInfo endpoint
• Monitor for unauthorized access to Active Directory join credentials
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and source item indicate that the FOG adInfo endpoint discloses the Active Directory join password in its domainpass JSON field. This issue is fixed in FOG version 1.5.10.1870. The vulnerability has a CVSS score of 7.5 and is considered HIGH severity. The response from the adInfo endpoint is consumed by host and group Active Directory configuration interfaces. There are no explicit details on the source of the report or additional affected versions.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.