{"id":"CVE-2026-92189","kind":"vulnerability","aliases":["CVE-2026-92189"],"related":[],"title":"Quest Foglight for Databases: unauthenticated file path flaw allows remote code execution","description":"Quest Foglight for Databases writeTopologySectionToFile External Control of File Path Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Quest Foglight for Databases. Authentication is not required to exploit this vulnerability.\n\nThe specific flaw exists within the writeTopologySectionToFile method. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. Was ZDI-CAN-29169.","summary":"Quest Foglight for Databases has a flaw in its writeTopologySectionToFile method where a user-supplied file path is used without validation. A remote attacker without credentials can execute arbitrary code in the context of SYSTEM.","severity":"critical","cvss":9.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Foglight for Databases","fixed":["8.3"],"affected":"< 8.3","ecosystem":"vendor"}],"ecosystems":[],"tags":["database-monitoring","foglight","quest","rce","self-hosted","vendor","windows"],"not_affected_if":["not-installed"],"how_to_check":"Check the installed Foglight for Databases version in the Foglight management server UI or installer; per ZDI, versions before 8.3 should be treated as exposed (the exact affected range is not published). Also check whether the Foglight server's network ports are reachable from untrusted networks.","fix":"Upgrade Foglight for Databases to 8.3 (per ZDI-26-861; Quest's own advisory not located)","status":"open","published_at":"2026-11-04T00:17:29+00:00","first_seen_at":"2026-11-04T00:46:18+00:00","triaged_at":"2026-11-04T00:47:33+00:00","updated_at":"2026-11-04T00:50:27+00:00","category":"vendor","confidence":0.65,"triage":{"at":"2026-11-04T00:47:33Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Quest Foglight for Databases: unauthenticated file path flaw allows remote code execution","impact":"high","summary":"Quest Foglight for Databases has a flaw in its writeTopologySectionToFile method where a user-supplied file path is used without validation. A remote attacker without credentials can execute arbitrary code in the context of SYSTEM.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["foglight","quest","windows","database-monitoring"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Remote attacker runs arbitrary code as SYSTEM on the server.","analyst_note":"Find affected and fixed Foglight for Databases versions and vendor advisory from the NVD entry and Quest/ZDI sources, and confirm the default network exposure.","how_to_check":"- Identify whether Quest Foglight for Databases is installed on the host, for example by checking installed programs or the Foglight service on Windows.\n- Confirm the installed version against the affected range; the sources do not list affected versions.","plain_action":"","needs_analyst":true,"not_affected_if":["not-installed"],"who_is_affected":"Installations of Quest Foglight for Databases are affected; the flaw is reachable remotely without authentication, and the attacker runs as SYSTEM. The sources do not name the affected versions or the specific network configuration, so whether a given deployment is exposed is unknown. Teams that do not run Foglight for Databases can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.00071,"input_tokens":4226,"output_tokens":574,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Find affected and fixed Foglight for Databases versions and vendor advisory from the NVD entry and Quest/ZDI sources, and confirm the default network exposure.","search":"'-2026':14A,17A '-92189':15A,18A '29169':156C 'affect':93C 'allow':9A,85C 'arbitrari':62B,90C 'attack':57B,87C,139C 'authent':100C 'code':11A,63B,80C,91C,146C 'context':66B,149C 'control':75C 'credenti':59B 'cve':13A,16A 'databas':4A,23B,36B,72C,99C 'database-monitor':22B 'databases':21A 'execut':12A,61B,81C,89C,145C 'exist':111C 'exploit':105C 'extern':74C 'file':6A,49B,77C,136C 'flaw':8A,39B,110C 'foglight':2A,19A,25B,34B,70C,97C 'for':20A 'host':30B 'instal':94C 'issu':117C 'lack':121C 'leverag':141C 'method':43B,115C 'monitor':24B 'oper':137C 'path':7A,50B,78C,130C 'prior':131C 'proper':123C 'quest':1A,26B,33B,69C,96C 'rce':27B 'remot':10A,56B,79C,86C 'requir':103C 'result':118C 'self':29B 'self-host':28B 'specif':109C 'suppli':48B,129C 'system':68B,151C 'unauthent':5A 'use':52B,133C 'user':47B,128C 'user-suppli':46B,127C 'valid':54B,124C 'vendor':31B 'vulner':82C,84C,107C,143C 'window':32B 'within':112C 'without':53B,58B 'writetopologysectiontofil':42B,73C,114C 'zdi':154C 'zdi-can':153C","nicknames":[],"mitigations":[],"who_affected":"Self-hosted Foglight for Databases installations on Windows, where the code runs as SYSTEM, in versions before 8.3 per ZDI. An attacker who can reach the server needs no login. Teams not running Foglight for Databases can skip this; restricting network access to the server limits exposure until you upgrade.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["foglightfordatabases","fordatabases"],"ptokens":["databases","foglight","for"],"labels":["critical","databasemonitoring","foglight","quest","rce","selfhosted","vendor","windows"],"campaign_type":null,"first_public_at":"2026-11-04T00:17:29+00:00","kev":null,"cvss_vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"zdi-disclosures@trendmicro.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-92189","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-92189","severity":null,"published_at":"2026-11-04T00:17:29+00:00","modified_at":"2026-11-04T00:17:29+00:00","first_seen_at":"2026-11-04T00:46:18+00:00","fetched_at":"2026-11-04T00:46:18+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-92189:1594","url":null,"severity":null,"published_at":"2026-11-04T00:50:27+00:00","modified_at":"2026-11-04T00:50:27+00:00","first_seen_at":"2026-11-04T00:50:27+00:00","fetched_at":"2026-11-04T00:50:27+00:00","note":"ZDI-26-861 says fixed in Foglight 8.3; no Quest vendor advisory found, so nothing marked verified. Affected range below 8.3 inferred from the fix statement. No exploitation or PoC reported. Default network exposure unconfirmed. Siblings 92187/92188/92190 share the 8.3 fix."}],"documents":[{"id":62160,"url":"https://www.zerodayinitiative.com/advisories/ZDI-26-861/","title":"ZDI-26-861 Quest Foglight for Databases writeTopologySectionToFile RCE","kind":"advisory","source":"analyst","publisher":null,"text":"Fixed in Foglight 8.3. CVSS 9.8 AV:N/PR:N. Reported to vendor 2026-04-30, public 2026-11-03.","published_at":null,"relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}