---
id: "CVE-2026-92195"
kind: "vulnerability"
aliases: ["CVE-2026-92195"]
title: "Quest Foglight for Databases: path traversal lets authenticated users run code"
severity: "high"
cvss: 8.8
epss: null
exploited: false
status: "open"
category: "vendor"
products: [{"name": "Foglight for Databases", "fixed": ["8.3"], "affected": "< 8.3", "ecosystem": "vendor"}]
ecosystems: []
tags: ["authenticated", "databases", "quest-foglight", "rce", "vendor", "windows"]
not_affected_if: ["not-running-foglight", "upgraded-to-8.3"]
published_at: "2026-11-04T00:17:30+00:00"
first_seen_at: "2026-11-04T00:46:19+00:00"
updated_at: "2026-11-04T00:52:43+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-92195", "first_seen_at": "2026-11-04T00:46:19+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-11-04T00:52:43+00:00"}]
---

# Quest Foglight for Databases: path traversal lets authenticated users run code

Quest Foglight for Databases has a directory traversal flaw in its loadEvolveLicense script. A logged-in user can supply a crafted path and run code as SYSTEM. ZDI says it is fixed in Foglight 8.3.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Foglight for Databases affected < 8.3 fixed 8.3

## How to check

Check your Foglight for Databases version in the Foglight management console or installer; versions earlier than 8.3 are affected per ZDI. Any logged-in account can reach the flaw, so also review who has Foglight accounts and whether the server is reachable from untrusted networks.

## Fix

Upgrade Foglight for Databases to 8.3 (per ZDI-26-856: 'Fixed in Foglight 8.3').

## Timeline

- 2026-11-04T00:46:19+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-92195
- 2026-11-04T00:52:43+00:00 analyst — ZDI-26-856 (read) says fixed in Foglight 8.3; no lower bound given, so affected is stated as before 8.3. Quest 8.3.0 release notes (July 2026) linked but not confirmed to list this CVE. Default reachability of loadEvolveLicense not stated by any source. No exploitation or PoC found. Nothing marked verified: ZDI is not the vendor.

## Documents

- [advisory] ZDI-26-856: Quest Foglight for Databases loadEvolveLicense Directory Traversal RCE https://www.zerodayinitiative.com/advisories/ZDI-26-856/
- [fix] Foglight for Databases 8.3.0 Release Notes https://support-public.cfm.quest.com/83297_FoglightforDatabases_8.3.0_ReleaseNotes.html

## From the sources

Quest Foglight for Databases loadEvolveLicense Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Quest Foglight for Databases. Authentication is required to exploit this vulnerability.

The specific flaw exists within the loadEvolveLicense script. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. Was ZDI-CAN-29232.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_