---
id: "CVE-2026-92199"
kind: "vulnerability"
aliases: ["CVE-2026-92199"]
title: "Quest Foglight for Databases: hardcoded key lets local user gain SYSTEM"
severity: "high"
cvss: 7.8
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "Foglight for Databases", "fixed": ["8.3"], "affected": "< 8.3", "ecosystem": "vendor"}]
ecosystems: []
tags: ["databases", "local-privilege-escalation", "package", "quest-foglight", "windows"]
not_affected_if: ["foglight-8.3-or-later", "not-installed"]
published_at: "2026-11-04T00:17:30+00:00"
first_seen_at: "2026-11-04T00:46:19+00:00"
updated_at: "2026-11-04T00:51:24+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-92199", "first_seen_at": "2026-11-04T00:46:19+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-11-04T00:51:24+00:00"}]
---

# Quest Foglight for Databases: hardcoded key lets local user gain SYSTEM

Quest Foglight for Databases ships a hardcoded cryptographic key in its EncryptionUtil symmetricDecrypt method. A local user who already runs low-privileged code can use it to escalate to SYSTEM and run arbitrary code.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Foglight for Databases affected < 8.3 fixed 8.3

## How to check

- Check whether Quest Foglight for Databases is installed on the Windows host (the Foglight server/cartridge install).
- Check the installed Foglight version in the Foglight console About page or installer; versions before 8.3 are affected per ZDI-26-863. Exact earliest affected version: unknown (ZDI lists none).
- Also check any other Foglight deployments you run for the same Foglight release.

## Fix

Upgrade Quest Foglight (for Databases) to 8.3 or later, per ZDI-26-863 ('Fixed in Foglight 8.3'). Quest's own advisory not found.

## Timeline

- 2026-11-04T00:46:19+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-92199
- 2026-11-04T00:51:24+00:00 analyst — ZDI-26-863 states fixed in Foglight 8.3; no exploitation or PoC seen. Source is ZDI, not Quest's page, so nothing marked verified. Sibling Foglight ZDI advisories (e.g. ZDI-26-854) also fixed in 8.3.

## Documents

- [advisory] ZDI-26-863 Quest Foglight for Databases EncryptionUtil Hardcoded Encryption Key LPE https://www.zerodayinitiative.com/advisories/ZDI-26-863/

## From the sources

Quest Foglight for Databases EncryptionUtil Hardcoded Encyption Key Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Quest Foglight for Databases. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.

The specific flaw exists within the symmetricDecrypt method. The issue results from the use of a hard-coded cryptographic key. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-29967.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_