---
id: "CVE-2026-92189"
kind: "vulnerability"
aliases: ["CVE-2026-92189"]
title: "Quest Foglight for Databases: unauthenticated file path flaw allows remote code execution"
severity: "critical"
cvss: 9.8
epss: null
exploited: false
status: "open"
category: "vendor"
products: [{"name": "Foglight for Databases", "fixed": ["8.3"], "affected": "< 8.3", "ecosystem": "vendor"}]
ecosystems: []
tags: ["database-monitoring", "foglight", "quest", "rce", "self-hosted", "vendor", "windows"]
not_affected_if: ["not-installed"]
published_at: "2026-11-04T00:17:29+00:00"
first_seen_at: "2026-11-04T00:46:18+00:00"
updated_at: "2026-11-04T00:50:27+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-92189", "first_seen_at": "2026-11-04T00:46:18+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-11-04T00:50:27+00:00"}]
---

# Quest Foglight for Databases: unauthenticated file path flaw allows remote code execution

Quest Foglight for Databases has a flaw in its writeTopologySectionToFile method where a user-supplied file path is used without validation. A remote attacker without credentials can execute arbitrary code in the context of SYSTEM.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Foglight for Databases affected < 8.3 fixed 8.3

## How to check

Check the installed Foglight for Databases version in the Foglight management server UI or installer; per ZDI, versions before 8.3 should be treated as exposed (the exact affected range is not published). Also check whether the Foglight server's network ports are reachable from untrusted networks.

## Fix

Upgrade Foglight for Databases to 8.3 (per ZDI-26-861; Quest's own advisory not located)

## Timeline

- 2026-11-04T00:46:18+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-92189
- 2026-11-04T00:50:27+00:00 analyst — ZDI-26-861 says fixed in Foglight 8.3; no Quest vendor advisory found, so nothing marked verified. Affected range below 8.3 inferred from the fix statement. No exploitation or PoC reported. Default network exposure unconfirmed. Siblings 92187/92188/92190 share the 8.3 fix.

## Documents

- [advisory] ZDI-26-861 Quest Foglight for Databases writeTopologySectionToFile RCE https://www.zerodayinitiative.com/advisories/ZDI-26-861/

## From the sources

Quest Foglight for Databases writeTopologySectionToFile External Control of File Path Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Quest Foglight for Databases. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the writeTopologySectionToFile method. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. Was ZDI-CAN-29169.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_