{"id":"CVE-2026-92195","kind":"vulnerability","aliases":["CVE-2026-92195"],"related":[],"title":"Quest Foglight for Databases: path traversal lets authenticated users run code","description":"Quest Foglight for Databases loadEvolveLicense Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Quest Foglight for Databases. Authentication is required to exploit this vulnerability.\n\nThe specific flaw exists within the loadEvolveLicense script. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. Was ZDI-CAN-29232.","summary":"Quest Foglight for Databases has a directory traversal flaw in its loadEvolveLicense script. A logged-in user can supply a crafted path and run code as SYSTEM. ZDI says it is fixed in Foglight 8.3.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Foglight for Databases","fixed":["8.3"],"affected":"< 8.3","ecosystem":"vendor"}],"ecosystems":[],"tags":["authenticated","databases","quest-foglight","rce","vendor","windows"],"not_affected_if":["not-running-foglight","upgraded-to-8.3"],"how_to_check":"Check your Foglight for Databases version in the Foglight management console or installer; versions earlier than 8.3 are affected per ZDI. Any logged-in account can reach the flaw, so also review who has Foglight accounts and whether the server is reachable from untrusted networks.","fix":"Upgrade Foglight for Databases to 8.3 (per ZDI-26-856: 'Fixed in Foglight 8.3').","status":"open","published_at":"2026-11-04T00:17:30+00:00","first_seen_at":"2026-11-04T00:46:19+00:00","triaged_at":"2026-11-04T00:47:37+00:00","updated_at":"2026-11-04T00:52:43+00:00","category":"vendor","confidence":0.7,"triage":{"at":"2026-11-04T00:47:37Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Quest Foglight for Databases: path traversal lets authenticated users run code","impact":"high","summary":"Quest Foglight for Databases has a directory traversal flaw in its loadEvolveLicense script. An attacker with an account can use a crafted path to run code as SYSTEM on the server.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["quest-foglight","windows","databases"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"Code runs as SYSTEM on the monitoring server","analyst_note":"Find the affected version range and vendor fix for Quest Foglight for Databases, and confirm whether the loadEvolveLicense script is reachable by default (ZDI-CAN-29232).","how_to_check":"unknown","plain_action":"","needs_analyst":true,"not_affected_if":["not-running-foglight"],"who_is_affected":"Organizations running Quest Foglight for Databases on Windows servers, where the loadEvolveLicense script is reachable by a logged-in user. The sources do not state the affected version range or which deployments expose the script, so teams should confirm their version with the vendor. Teams not running Foglight for Databases can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000662,"input_tokens":4223,"output_tokens":479,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the affected version range and vendor fix for Quest Foglight for Databases, and confirm whether the loadEvolveLicense script is reachable by default (ZDI-CAN-29232).","search":"'-2026':13A,16A '-92195':14A,17A '29232':148C '8.3':64B 'affect':86C 'allow':78C 'arbitrari':83C 'attack':80C,131C 'authent':8A,21B,93C 'code':11A,54B,73C,84C,138C 'context':141C 'craft':50B 'cve':12A,15A 'databas':4A,22B,32B,68C,92C 'databases':20A 'directori':35B,70C 'execut':74C,82C,137C 'exist':103C 'exploit':97C 'file':128C 'fix':61B 'flaw':37B,102C 'foglight':2A,18A,25B,30B,63B,66C,90C 'for':19A 'instal':87C 'issu':109C 'lack':113C 'let':7A 'leverag':133C 'loadevolvelicens':40B,69C,106C 'log':44B 'logged-in':43B 'oper':129C 'path':5A,51B,122C 'prior':123C 'proper':115C 'quest':1A,24B,29B,65C,89C 'quest-foglight':23B 'rce':26B 'remot':72C,79C 'requir':95C 'result':110C 'run':10A,53B 'say':58B 'script':41B,107C 'specif':101C 'suppli':48B,121C 'system':56B,143C 'travers':6A,36B,71C 'use':125C 'user':9A,46B,120C 'user-suppli':119C 'valid':116C 'vendor':27B 'vulner':75C,77C,99C,135C 'window':28B 'within':104C 'zdi':57B,146C 'zdi-can':145C","nicknames":[],"mitigations":[],"who_affected":"Teams running Quest Foglight for Databases earlier than 8.3, where any authenticated user can reach the loadEvolveLicense script over the network and run code as SYSTEM. ZDI does not say whether the script is exposed by default or give a lowest affected version. Teams not running Foglight, or already on 8.3, can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["foglightfordatabases","fordatabases"],"ptokens":["databases","foglight","for"],"labels":["authenticated","databases","high","questfoglight","rce","vendor","windows"],"campaign_type":null,"first_public_at":"2026-11-04T00:17:30+00:00","kev":null,"cvss_vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"zdi-disclosures@trendmicro.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-92195","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-92195","severity":null,"published_at":"2026-11-04T00:17:30+00:00","modified_at":"2026-11-04T00:17:30+00:00","first_seen_at":"2026-11-04T00:46:19+00:00","fetched_at":"2026-11-04T00:46:19+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-92195:1603","url":null,"severity":null,"published_at":"2026-11-04T00:52:43+00:00","modified_at":"2026-11-04T00:52:43+00:00","first_seen_at":"2026-11-04T00:52:43+00:00","fetched_at":"2026-11-04T00:52:43+00:00","note":"ZDI-26-856 (read) says fixed in Foglight 8.3; no lower bound given, so affected is stated as before 8.3. Quest 8.3.0 release notes (July 2026) linked but not confirmed to list this CVE. Default reachability of loadEvolveLicense not stated by any source. No exploitation or PoC found. Nothing marked verified: ZDI is not the vendor."}],"documents":[{"id":62171,"url":"https://www.zerodayinitiative.com/advisories/ZDI-26-856/","title":"ZDI-26-856: Quest Foglight for Databases loadEvolveLicense Directory Traversal RCE","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":62172,"url":"https://support-public.cfm.quest.com/83297_FoglightforDatabases_8.3.0_ReleaseNotes.html","title":"Foglight for Databases 8.3.0 Release Notes","kind":"release","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}