Live › vulnerability › CVE-2026-92195
Quest Foglight for Databases has a directory traversal flaw in its loadEvolveLicense script. A logged-in user can supply a crafted path and run code as SYSTEM. ZDI says it is fixed in Foglight 8.3.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-04 00:46 UTC. All times on this page are UTC.
Teams running Quest Foglight for Databases earlier than 8.3, where any authenticated user can reach the loadEvolveLicense script over the network and run code as SYSTEM. ZDI does not say whether the script is exposed by default or give a lowest affected version. Teams not running Foglight, or already on 8.3, can skip it.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| Foglight for Databases | vendor | < 8.3 | 8.3 |
Upgrade Foglight for Databases to 8.3 (per ZDI-26-856: ).
Fixed in Foglight 8.3Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Quest Foglight for Databases loadEvolveLicense Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Quest Foglight for Databases. Authentication is required to exploit this vulnerability.
The specific flaw exists within the loadEvolveLicense script. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. Was ZDI-CAN-29232.
This page as .md · .json · in your agent: get_signal("CVE-2026-92195")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.