---
id: "CVE-2026-92198"
kind: "vulnerability"
aliases: ["CVE-2026-92198"]
title: "Quest Foglight for Databases: XML parsing flaw leaks server-side data to remote attackers"
severity: "high"
cvss: 8.2
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "Foglight for Databases", "fixed": ["8.3"], "affected": "< 8.3 (lower bound not stated)", "ecosystem": "vendor"}]
ecosystems: []
tags: ["databases", "other", "quest-foglight", "self-hosted", "xxe"]
not_affected_if: ["product-not-installed"]
published_at: "2026-11-04T00:17:30+00:00"
first_seen_at: "2026-11-04T00:46:19+00:00"
updated_at: "2026-11-04T00:51:43+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-92198", "first_seen_at": "2026-11-04T00:46:19+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-11-04T00:51:43+00:00"}]
---

# Quest Foglight for Databases: XML parsing flaw leaks server-side data to remote attackers

Quest Foglight for Databases has an XML External Entity flaw in its getSource method that lets an unauthenticated remote attacker make the server fetch arbitrary URIs. The fetched contents are embedded back into the XML document, which discloses information from the application.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Foglight for Databases affected < 8.3 (lower bound not stated) fixed 8.3

## How to check

Check your Foglight for Databases version in the Foglight management server UI or your install records. Anything older than 8.3 should be treated as exposed, since ZDI gives no lower bound. Also check whether the Foglight management server is reachable from untrusted networks, because the flaw needs no authentication.

## Fix

Upgrade Foglight for Databases to 8.3 (per ZDI-26-864; Quest's own advisory not located).

## Timeline

- 2026-11-04T00:46:19+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-92198
- 2026-11-04T00:51:43+00:00 analyst — ZDI-26-864 (Nov 3 2026, reported to vendor 2026-06-26) says fixed in Foglight 8.3; no Quest advisory found, so nothing marked verified. Affected versions below 8.3 not stated by ZDI. No exploitation or PoC seen.

## Documents

- [advisory] ZDI-26-864 Quest Foglight for Databases getSource XXE https://www.zerodayinitiative.com/advisories/ZDI-26-864/
- [describes] NVD CVE-2026-92198 https://nvd.nist.gov/vuln/detail/CVE-2026-92198

## From the sources

Quest Foglight for Databases getSource XML External Entity Processing Information Disclosure Vulnerability. This vulnerability allows remote attackers to initiate arbitrary server-side requests on affected installations of Quest Foglight for Databases. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the getSource method. Due to the improper restriction of XML External Entity (XXE) references, a crafted document specifying a URI causes the XML parser to access the URI and embed the contents back into the XML document for further processing. An attacker can leverage this vulnerability to disclose information in the context of the application. Was ZDI-CAN-29934.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_