{"id":"CVE-2026-92199","kind":"vulnerability","aliases":["CVE-2026-92199"],"related":[],"title":"Quest Foglight for Databases: hardcoded key lets local user gain SYSTEM","description":"Quest Foglight for Databases EncryptionUtil Hardcoded Encyption Key Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Quest Foglight for Databases. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.\n\nThe specific flaw exists within the symmetricDecrypt method. The issue results from the use of a hard-coded cryptographic key. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-29967.","summary":"Quest Foglight for Databases ships a hardcoded cryptographic key in its EncryptionUtil symmetricDecrypt method. A local user who already runs low-privileged code can use it to escalate to SYSTEM and run arbitrary code.","severity":"high","cvss":7.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Foglight for Databases","fixed":["8.3"],"affected":"< 8.3","ecosystem":"vendor"}],"ecosystems":[],"tags":["databases","local-privilege-escalation","package","quest-foglight","windows"],"not_affected_if":["foglight-8.3-or-later","not-installed"],"how_to_check":"- Check whether Quest Foglight for Databases is installed on the Windows host (the Foglight server/cartridge install).\n- Check the installed Foglight version in the Foglight console About page or installer; versions before 8.3 are affected per ZDI-26-863. Exact earliest affected version: unknown (ZDI lists none).\n- Also check any other Foglight deployments you run for the same Foglight release.","fix":"Upgrade Quest Foglight (for Databases) to 8.3 or later, per ZDI-26-863 ('Fixed in Foglight 8.3'). Quest's own advisory not found.","status":"open","published_at":"2026-11-04T00:17:30+00:00","first_seen_at":"2026-11-04T00:46:19+00:00","triaged_at":"2026-11-04T00:47:49+00:00","updated_at":"2026-11-04T00:51:24+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-04T00:47:49Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Quest Foglight for Databases: hardcoded key lets local user gain SYSTEM","impact":"high","summary":"Quest Foglight for Databases ships a hardcoded cryptographic key in its EncryptionUtil symmetricDecrypt method. A local user who already runs low-privileged code can use it to escalate to SYSTEM and run arbitrary code.","audience":"businesses","category":"package","nicknames":[],"who_cares":["quest-foglight","windows","databases"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"Local low-privileged user gains SYSTEM and runs arbitrary code","analyst_note":"Find the affected and fixed Foglight for Databases versions and vendor advisory via the ZDI-CAN-29967 entry or Quest's security page.","how_to_check":"- Check whether Quest Foglight for Databases is installed on the host.\n- Confirm the installed version against the affected range in the NVD entry: unknown.","plain_action":"","needs_analyst":true,"not_affected_if":["not-installed"],"who_is_affected":"Hosts running Quest Foglight for Databases where a local, low-privileged user or process can execute code. The sources do not list affected version ranges. Systems without Foglight for Databases installed can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000678,"input_tokens":4255,"output_tokens":505,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the affected and fixed Foglight for Databases versions and vendor advisory via the ZDI-CAN-29967 entry or Quest's security page.","search":"'-2026':13A,16A '-92199':14A,17A '29967':160C 'abil':100C 'affect':87C 'allow':80C 'alreadi':49B 'arbitrari':64B,149C 'attack':82C,95C,139C 'code':54B,65B,106C,135C,150C 'context':153C 'cryptograph':38B,136C 'cve':12A,15A 'databas':4A,21B,34B,69C,93C 'databases':20A 'encryptionutil':42B,70C 'encypt':72C 'escal':25B,59B,76C,84C,145C 'execut':102C,148C 'exist':120C 'exploit':114C 'first':97C 'flaw':119C 'foglight':2A,18A,29B,32B,67C,91C 'for':19A 'gain':10A 'hard':134C 'hard-cod':133C 'hardcod':5A,37B,71C 'instal':88C 'issu':126C 'key':6A,39B,73C,137C 'let':7A 'leverag':141C 'local':8A,23B,46B,74C,81C 'local-privilege-escal':22B 'low':52B,104C 'low-privileg':51B,103C 'method':44B,124C 'must':96C 'obtain':98C 'order':112C 'packag':26B 'privileg':24B,53B,75C,85C,105C,146C 'quest':1A,28B,31B,66C,90C 'quest-foglight':27B 'result':127C 'run':50B,63B 'ship':35B 'specif':118C 'symmetricdecrypt':43B,123C 'system':11A,61B,110C,155C 'target':109C 'use':56B,130C 'user':9A,47B 'vulner':77C,79C,116C,143C 'window':30B 'within':121C 'zdi':158C 'zdi-can':157C","nicknames":[],"mitigations":[],"who_affected":"Windows hosts running Quest Foglight for Databases before 8.3 where an attacker or malicious process can already run low-privileged code locally. The flaw is a hardcoded key in the symmetricDecrypt method of EncryptionUtil, which lets that user escalate to SYSTEM. Hosts without Foglight for Databases, or already on 8.3 or later, can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["foglightfordatabases","fordatabases"],"ptokens":["databases","foglight","for"],"labels":["databases","high","localprivilegeescalation","package","questfoglight","windows"],"campaign_type":null,"first_public_at":"2026-11-04T00:17:30+00:00","kev":null,"cvss_vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"zdi-disclosures@trendmicro.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-92199","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-92199","severity":null,"published_at":"2026-11-04T00:17:30+00:00","modified_at":"2026-11-04T00:17:30+00:00","first_seen_at":"2026-11-04T00:46:19+00:00","fetched_at":"2026-11-04T00:46:19+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-92199:1599","url":null,"severity":null,"published_at":"2026-11-04T00:51:24+00:00","modified_at":"2026-11-04T00:51:24+00:00","first_seen_at":"2026-11-04T00:51:24+00:00","fetched_at":"2026-11-04T00:51:24+00:00","note":"ZDI-26-863 states fixed in Foglight 8.3; no exploitation or PoC seen. Source is ZDI, not Quest's page, so nothing marked verified. Sibling Foglight ZDI advisories (e.g. ZDI-26-854) also fixed in 8.3."}],"documents":[{"id":62164,"url":"https://www.zerodayinitiative.com/advisories/ZDI-26-863/","title":"ZDI-26-863 Quest Foglight for Databases EncryptionUtil Hardcoded Encryption Key LPE","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}