---
id: "CVE-2026-92196"
kind: "vulnerability"
aliases: ["CVE-2026-92196"]
title: "Quest Foglight for Databases: template injection lets authenticated users run code"
severity: "high"
cvss: 7.2
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "Foglight for Databases", "fixed": ["8.3"], "affected": "< 8.3", "ecosystem": "vendor"}]
ecosystems: []
tags: ["database-monitoring", "other", "quest-foglight", "windows"]
not_affected_if: ["no-foglight-installed", "unauthenticated-only-access"]
published_at: "2026-11-04T00:17:30+00:00"
first_seen_at: "2026-11-04T00:46:19+00:00"
updated_at: "2026-11-04T00:52:36+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-92196", "first_seen_at": "2026-11-04T00:46:19+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-11-04T00:52:36+00:00"}]
---

# Quest Foglight for Databases: template injection lets authenticated users run code

Quest Foglight for Databases has a server-side template injection flaw in its renderTemplateString method, where user-supplied input is passed to the template engine without validation. An authenticated attacker can execute arbitrary code in the context of SYSTEM on the affected server.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Foglight for Databases affected < 8.3 fixed 8.3

## How to check

In the Foglight management console check the installed Foglight / Foglight for Databases version (Help > About); versions below 8.3 are in scope per ZDI. Review which accounts can log in to the console.

## Fix

Upgrade to Foglight 8.3 (per ZDI-26-866; Quest's own advisory not located)

## Timeline

- 2026-11-04T00:46:19+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-92196
- 2026-11-04T00:52:36+00:00 analyst — ZDI-26-866 states 'Fixed in Foglight 8.3'; affected range inferred as below that, not vendor-confirmed. Quest's own advisory not found, so nothing marked verified. No exploitation or PoC seen.

## Documents

- [advisory] ZDI-26-866 Quest Foglight for Databases renderTemplateString SSTI RCE https://www.zerodayinitiative.com/advisories/ZDI-26-866/

## From the sources

Quest Foglight for Databases renderTemplateString Server-Side Template Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Quest Foglight for Databases. Authentication is required to exploit this vulnerability.

The specific flaw exists within the renderTemplateString method. The issue results from the lack of proper validation of a user-supplied string before processing it with the template engine. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. Was ZDI-CAN-29889.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_