Live › vulnerability › CVE-2026-92198
Quest Foglight for Databases has an XML External Entity flaw in its getSource method that lets an unauthenticated remote attacker make the server fetch arbitrary URIs. The fetched contents are embedded back into the XML document, which discloses information from the application.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-04 00:46 UTC. All times on this page are UTC.
Self-hosted Foglight for Databases installations older than 8.3 are exposed. An unauthenticated attacker who can reach the server can send crafted XML to the getSource method, making the server fetch URIs and return the contents, which discloses data from the application. Teams that do not run Foglight, or that have already upgraded to 8.3, can skip it.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| Foglight for Databases | vendor | < 8.3 (lower bound not stated) | 8.3 |
Upgrade Foglight for Databases to 8.3 (per ZDI-26-864; Quest's own advisory not located).
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Quest Foglight for Databases getSource XML External Entity Processing Information Disclosure Vulnerability. This vulnerability allows remote attackers to initiate arbitrary server-side requests on affected installations of Quest Foglight for Databases. Authentication is not required to exploit this vulnerability.
The specific flaw exists within the getSource method. Due to the improper restriction of XML External Entity (XXE) references, a crafted document specifying a URI causes the XML parser to access the URI and embed the contents back into the XML document for further processing. An attacker can leverage this vulnerability to disclose information in the context of the application. Was ZDI-CAN-29934.
This page as .md · .json · in your agent: get_signal("CVE-2026-92198")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.