{"id":"CVE-2026-92191","kind":"vulnerability","aliases":["CVE-2026-92191"],"related":[],"title":"Quest Foglight for Databases: flawed authorization lets attackers run code","description":"Quest Foglight for Databases runScript Incorrect Authorization Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Quest Foglight for Databases. Authentication is required to exploit this vulnerability.\n\nThe specific flaw exists within the runScript function. The issue results from incorrect authorization prior to allowing access to functionality. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. Was ZDI-CAN-29192.","summary":"Foglight for Databases has an incorrect authorization check in its runScript function. A logged-in remote user with low privileges can run code as SYSTEM. ZDI reports it fixed in Foglight 8.3.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Foglight for Databases","fixed":["8.3"],"affected":"8.2.0 (CVE record); earlier versions unconfirmed","ecosystem":"vendor"}],"ecosystems":[],"tags":["authenticated","database-monitoring","other","quest-foglight","rce","windows"],"not_affected_if":["unknown"],"how_to_check":"In the Foglight UI, check the installed version (Help > About). Version 8.2.0 is listed as affected and 8.3 as the fix. Also review which accounts can log in to the Foglight management server and whether the runScript function is reachable by low-privilege users.","fix":"Upgrade Foglight for Databases to 8.3 (per ZDI-26-859; Quest advisory not found)","status":"open","published_at":"2026-11-04T00:17:29+00:00","first_seen_at":"2026-11-04T00:46:18+00:00","triaged_at":"2026-11-04T00:47:40+00:00","updated_at":"2026-11-04T00:53:50+00:00","category":"other","confidence":0.7,"triage":{"at":"2026-11-04T00:47:40Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Quest Foglight for Databases: flawed authorization lets attackers run code","impact":"high","summary":"Quest Foglight for Databases has an incorrect authorization check in its runScript function. An authenticated remote attacker can execute arbitrary code in the context of SYSTEM.","audience":"businesses","category":"other","nicknames":[],"who_cares":["quest-foglight","windows","database-monitoring"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"Attacker runs arbitrary code as SYSTEM on the monitoring server","analyst_note":"Find affected version ranges and vendor fix from Quest advisory or ZDI-CAN-29192 page; the NVD entry alone does not state them.","how_to_check":"unknown","plain_action":"","needs_analyst":true,"not_affected_if":["unknown"],"who_is_affected":"Organisations running Quest Foglight for Databases. Authentication is required to exploit this flaw, according to the description; the sources do not list affected version ranges.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000628,"input_tokens":4202,"output_tokens":416,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find affected version ranges and vendor fix from Quest advisory or ZDI-CAN-29192 page; the NVD entry alone does not state them.","search":"'-2026':12A,15A '-92191':13A,16A '29192':136C '8.3':62B 'access':115C 'affect':84C 'allow':76C,114C 'arbitrari':81C 'attack':8A,78C,119C 'authent':20B,91C 'author':6A,36B,69C,111C 'check':37B 'code':10A,53B,71C,82C,126C 'context':129C 'cve':11A,14A 'databas':4A,22B,32B,66C,90C 'database-monitor':21B 'databases':19A 'execut':72C,80C,125C 'exist':101C 'exploit':95C 'fix':59B 'flaw':5A,100C 'foglight':2A,17A,27B,30B,61B,64C,88C 'for':18A 'function':41B,105C,117C 'incorrect':35B,68C,110C 'instal':85C 'issu':107C 'let':7A 'leverag':121C 'log':44B 'logged-in':43B 'low':49B 'monitor':23B 'prior':112C 'privileg':50B 'quest':1A,26B,63C,87C 'quest-foglight':25B 'rce':28B 'remot':46B,70C,77C 'report':57B 'requir':93C 'result':108C 'run':9A,52B 'runscript':40B,67C,104C 'specif':99C 'system':55B,131C 'user':47B 'vulner':73C,75C,97C,123C 'window':29B 'within':102C 'zdi':56B,134C 'zdi-can':133C","nicknames":[],"mitigations":[],"who_affected":"Teams running Quest Foglight for Databases 8.2.0 (the version listed in the CVE record) on Windows. The attacker needs a valid login, so exposure depends on who has accounts on the Foglight server. Anyone not running Foglight for Databases can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["foglightfordatabases","fordatabases"],"ptokens":["databases","foglight","for"],"labels":["authenticated","databasemonitoring","high","other","questfoglight","rce","windows"],"campaign_type":null,"first_public_at":"2026-11-04T00:17:29+00:00","kev":null,"cvss_vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"zdi-disclosures@trendmicro.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-92191","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-92191","severity":null,"published_at":"2026-11-04T00:17:29+00:00","modified_at":"2026-11-04T00:17:29+00:00","first_seen_at":"2026-11-04T00:46:18+00:00","fetched_at":"2026-11-04T00:46:18+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-92191:1606","url":null,"severity":null,"published_at":"2026-11-04T00:53:50+00:00","modified_at":"2026-11-04T00:53:50+00:00","first_seen_at":"2026-11-04T00:53:50+00:00","fetched_at":"2026-11-04T00:53:50+00:00","note":"ZDI-26-859 (coordinator advisory, not Quest's own page) says fixed in Foglight 8.3; CVE record lists 8.2.0 affected. No Quest advisory found, so nothing marked verified. No exploitation or PoC seen."}],"documents":[{"id":62184,"url":"https://www.zerodayinitiative.com/advisories/ZDI-26-859/","title":"ZDI-26-859: Quest Foglight for Databases runScript Incorrect Authorization RCE","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":62185,"url":"https://cvepremium.circl.lu/search?assigner=zdi","title":"CVE-2026-92191 CVE record (affected: 8.2.0)","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}