---
id: "CVE-2026-92191"
kind: "vulnerability"
aliases: ["CVE-2026-92191"]
title: "Quest Foglight for Databases: flawed authorization lets attackers run code"
severity: "high"
cvss: 8.8
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "Foglight for Databases", "fixed": ["8.3"], "affected": "8.2.0 (CVE record); earlier versions unconfirmed", "ecosystem": "vendor"}]
ecosystems: []
tags: ["authenticated", "database-monitoring", "other", "quest-foglight", "rce", "windows"]
not_affected_if: ["unknown"]
published_at: "2026-11-04T00:17:29+00:00"
first_seen_at: "2026-11-04T00:46:18+00:00"
updated_at: "2026-11-04T00:53:50+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-92191", "first_seen_at": "2026-11-04T00:46:18+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-11-04T00:53:50+00:00"}]
---

# Quest Foglight for Databases: flawed authorization lets attackers run code

Foglight for Databases has an incorrect authorization check in its runScript function. A logged-in remote user with low privileges can run code as SYSTEM. ZDI reports it fixed in Foglight 8.3.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Foglight for Databases affected 8.2.0 (CVE record); earlier versions unconfirmed fixed 8.3

## How to check

In the Foglight UI, check the installed version (Help > About). Version 8.2.0 is listed as affected and 8.3 as the fix. Also review which accounts can log in to the Foglight management server and whether the runScript function is reachable by low-privilege users.

## Fix

Upgrade Foglight for Databases to 8.3 (per ZDI-26-859; Quest advisory not found)

## Timeline

- 2026-11-04T00:46:18+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-92191
- 2026-11-04T00:53:50+00:00 analyst — ZDI-26-859 (coordinator advisory, not Quest's own page) says fixed in Foglight 8.3; CVE record lists 8.2.0 affected. No Quest advisory found, so nothing marked verified. No exploitation or PoC seen.

## Documents

- [advisory] ZDI-26-859: Quest Foglight for Databases runScript Incorrect Authorization RCE https://www.zerodayinitiative.com/advisories/ZDI-26-859/
- [describes] CVE-2026-92191 CVE record (affected: 8.2.0) https://cvepremium.circl.lu/search?assigner=zdi

## From the sources

Quest Foglight for Databases runScript Incorrect Authorization Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Quest Foglight for Databases. Authentication is required to exploit this vulnerability.

The specific flaw exists within the runScript function. The issue results from incorrect authorization prior to allowing access to functionality. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. Was ZDI-CAN-29192.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_