{"id":"CVE-2026-92198","kind":"vulnerability","aliases":["CVE-2026-92198"],"related":[],"title":"Quest Foglight for Databases: XML parsing flaw leaks server-side data to remote attackers","description":"Quest Foglight for Databases getSource XML External Entity Processing Information Disclosure Vulnerability. This vulnerability allows remote attackers to initiate arbitrary server-side requests on affected installations of Quest Foglight for Databases. Authentication is not required to exploit this vulnerability.\n\nThe specific flaw exists within the getSource method. Due to the improper restriction of XML External Entity (XXE) references, a crafted document specifying a URI causes the XML parser to access the URI and embed the contents back into the XML document for further processing. An attacker can leverage this vulnerability to disclose information in the context of the application. Was ZDI-CAN-29934.","summary":"Quest Foglight for Databases has an XML External Entity flaw in its getSource method that lets an unauthenticated remote attacker make the server fetch arbitrary URIs. The fetched contents are embedded back into the XML document, which discloses information from the application.","severity":"high","cvss":8.2,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Foglight for Databases","fixed":["8.3"],"affected":"< 8.3 (lower bound not stated)","ecosystem":"vendor"}],"ecosystems":[],"tags":["databases","other","quest-foglight","self-hosted","xxe"],"not_affected_if":["product-not-installed"],"how_to_check":"Check your Foglight for Databases version in the Foglight management server UI or your install records. Anything older than 8.3 should be treated as exposed, since ZDI gives no lower bound. Also check whether the Foglight management server is reachable from untrusted networks, because the flaw needs no authentication.","fix":"Upgrade Foglight for Databases to 8.3 (per ZDI-26-864; Quest's own advisory not located).","status":"open","published_at":"2026-11-04T00:17:30+00:00","first_seen_at":"2026-11-04T00:46:19+00:00","triaged_at":"2026-11-04T00:47:44+00:00","updated_at":"2026-11-04T00:51:43+00:00","category":"other","confidence":0.7,"triage":{"at":"2026-11-04T00:47:44Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Quest Foglight for Databases: XML parsing flaw leaks server-side data to remote attackers","impact":"medium","summary":"Quest Foglight for Databases has an XML External Entity flaw in its getSource method that lets an unauthenticated remote attacker make the server fetch arbitrary URIs. The fetched contents are embedded back into the XML document, which discloses information from the application.","audience":"businesses","category":"other","nicknames":[],"who_cares":["quest-foglight","databases","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Server fetches attacker-chosen URIs and leaks internal data","analyst_note":"Check the NVD entry and ZDI-CAN-29934 advisory for affected versions and the vendor fix.","how_to_check":"- Confirm whether Quest Foglight for Databases is installed in your environment; the sources do not name affected versions.\n- unknown","plain_action":"","needs_analyst":true,"not_affected_if":["product-not-installed"],"who_is_affected":"Organizations running Quest Foglight for Databases, where the getSource method accepts XML documents from remote clients. The sources do not state which versions or configurations are affected, so the team should check their own deployment. Teams not running Foglight for Databases can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000679,"input_tokens":4242,"output_tokens":509,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check the NVD entry and ZDI-CAN-29934 advisory for affected versions and the vendor fix.","search":"'-2026':17A,20A '-92198':18A,21A '29934':180C 'access':146C 'affect':101C 'allow':90C 'applic':75B,175C 'arbitrari':58B,95C 'attack':15A,53B,92C,162C 'authent':108C 'back':65B,153C 'caus':141C 'content':62B,152C 'context':172C 'craft':136C 'cve':16A,19A 'data':12A 'databas':4A,25B,37B,79C,107C 'databases':24A 'disclos':71B,168C 'disclosur':86C 'document':69B,137C,157C 'due':124C 'emb':150C 'embed':64B 'entiti':42B,83C,132C 'exist':119C 'exploit':113C 'extern':41B,82C,131C 'fetch':57B,61B 'flaw':7A,43B,118C 'foglight':2A,22A,29B,35B,77C,105C 'for':23A 'getsourc':46B,80C,122C 'host':32B 'improp':127C 'inform':72B,85C,169C 'initi':94C 'instal':102C 'leak':8A 'let':49B 'leverag':164C 'make':54B 'method':47B,123C 'pars':6A 'parser':144C 'process':84C,160C 'quest':1A,28B,34B,76C,104C 'quest-foglight':27B 'refer':134C 'remot':14A,52B,91C 'request':99C 'requir':111C 'restrict':128C 'self':31B 'self-host':30B 'server':10A,56B,97C 'server-sid':9A,96C 'side':11A,98C 'specif':117C 'specifi':138C 'unauthent':51B 'uri':59B,140C,148C 'vulner':87C,89C,115C,166C 'within':120C 'xml':5A,40B,68B,81C,130C,143C,156C 'xxe':33B,133C 'zdi':178C 'zdi-can':177C","nicknames":[],"mitigations":[],"who_affected":"Self-hosted Foglight for Databases installations older than 8.3 are exposed. An unauthenticated attacker who can reach the server can send crafted XML to the getSource method, making the server fetch URIs and return the contents, which discloses data from the application. Teams that do not run Foglight, or that have already upgraded to 8.3, can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["foglightfordatabases","fordatabases"],"ptokens":["databases","foglight","for"],"labels":["databases","high","other","questfoglight","selfhosted","xxe"],"campaign_type":null,"first_public_at":"2026-11-04T00:17:30+00:00","kev":null,"cvss_vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L","cvss_by":"zdi-disclosures@trendmicro.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-92198","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-92198","severity":null,"published_at":"2026-11-04T00:17:30+00:00","modified_at":"2026-11-04T00:17:30+00:00","first_seen_at":"2026-11-04T00:46:19+00:00","fetched_at":"2026-11-04T00:46:19+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-92198:1600","url":null,"severity":null,"published_at":"2026-11-04T00:51:43+00:00","modified_at":"2026-11-04T00:51:43+00:00","first_seen_at":"2026-11-04T00:51:43+00:00","fetched_at":"2026-11-04T00:51:43+00:00","note":"ZDI-26-864 (Nov 3 2026, reported to vendor 2026-06-26) says fixed in Foglight 8.3; no Quest advisory found, so nothing marked verified. Affected versions below 8.3 not stated by ZDI. No exploitation or PoC seen."}],"documents":[{"id":62167,"url":"https://www.zerodayinitiative.com/advisories/ZDI-26-864/","title":"ZDI-26-864 Quest Foglight for Databases getSource XXE","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":62168,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-92198","title":"NVD CVE-2026-92198","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}