{"id":"CVE-2026-92200","kind":"vulnerability","aliases":["CVE-2026-92200"],"related":[],"title":"Quest Foglight for Databases: folder permissions let local users gain SYSTEM","description":"Quest Foglight for Databases Incorrect Permission Assignment Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Quest Foglight for Databases. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.\n\nThe specific flaw exists within the product installer. The issue results from incorrect permissions on a folder used by the product. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-31118.","summary":"ZDI-26-865: the Foglight for Databases installer leaves incorrect permissions on a folder it uses. A local low-privileged user can abuse this to run code as SYSTEM. ZDI says it is fixed in Foglight 8.3. No exploitation or public PoC known.","severity":"high","cvss":7.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Foglight for Databases","fixed":["8.3"],"affected":"< 8.3 (exact lower bound not stated)","ecosystem":"vendor"}],"ecosystems":[],"tags":["database-monitoring","quest-foglight","vendor","windows"],"not_affected_if":["no-local-untrusted-users","not-installed"],"how_to_check":"- On Windows hosts, check the installed Foglight for Databases version (Programs and Features); versions before 8.3 are affected per ZDI.\n- The advisory does not name the folder. Review ACLs on the Foglight install and installer directories (icacls) for write access by non-admin users; this path is unconfirmed.","fix":"Upgrade to Foglight 8.3 (per ZDI-26-865; Quest's own advisory not found)","status":"open","published_at":"2026-11-04T00:17:31+00:00","first_seen_at":"2026-11-04T00:46:19+00:00","triaged_at":"2026-11-04T00:47:48+00:00","updated_at":"2026-11-04T00:51:28+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-11-04T00:47:48Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Quest Foglight for Databases: folder permissions let local users gain SYSTEM","impact":"high","summary":"Quest Foglight for Databases sets incorrect permissions on a folder its installer uses. A local user with low privileges can abuse this to run code as SYSTEM on Windows.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["windows","quest-foglight","database-monitoring"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"local low-privilege user runs arbitrary code as SYSTEM","analyst_note":"Confirm affected versions, fixed version and the vulnerable folder path from the vendor advisory or the ZDI advisory for ZDI-CAN-31118.","how_to_check":"- Check whether Quest Foglight for Databases is installed on Windows servers or workstations\n- Review the vendor's advisory for the affected versions and folder ACLs\n- unknown for the exact file or folder path from the sources","plain_action":"","needs_analyst":true,"not_affected_if":["not-installed","no-local-untrusted-users"],"who_is_affected":"Only machines where Quest Foglight for Databases is installed are exposed. An attacker needs a low-privileged foothold on that machine first, so systems with no local user access risk less. Remote attackers without a local account cannot use this flaw directly.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000689,"input_tokens":4232,"output_tokens":532,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm affected versions, fixed version and the vulnerable folder path from the vendor advisory or the ZDI advisory for ZDI-CAN-31118.","search":"'-2026':13A,16A '-26':30B '-865':31B '-92200':14A,17A '31118':166C '8.3':66B 'abil':106C 'abus':52B 'affect':93C 'allow':86C 'arbitrari':155C 'assign':79C 'attack':88C,101C,145C 'code':56B,112C,156C 'context':159C 'cve':12A,15A 'databas':4A,22B,35B,76C,99C 'database-monitor':21B 'databases':20A 'escal':82C,90C,151C 'execut':108C,154C 'exist':126C 'exploit':68B,120C 'first':103C 'fix':63B 'flaw':125C 'foglight':2A,18A,26B,33B,65B,74C,97C 'folder':5A,42B,139C 'for':19A 'gain':10A 'incorrect':38B,77C,135C 'instal':36B,94C,130C 'issu':132C 'known':72B 'leav':37B 'let':7A 'leverag':147C 'local':8A,46B,80C,87C 'low':48B,110C 'low-privileg':47B,109C 'monitor':23B 'must':102C 'obtain':104C 'order':118C 'permiss':6A,39B,78C,136C 'poc':71B 'privileg':49B,81C,91C,111C,152C 'product':129C,143C 'public':70B 'quest':1A,25B,73C,96C 'quest-foglight':24B 'result':133C 'run':55B 'say':60B 'specif':124C 'system':11A,58B,116C,161C 'target':115C 'use':44B,140C 'user':9A,50B 'vendor':27B 'vulner':83C,85C,122C,149C 'window':28B 'within':127C 'zdi':29B,59B,164C 'zdi-can':163C","nicknames":[],"mitigations":[],"who_affected":"Only machines where Quest Foglight for Databases is installed are exposed. An attacker needs a low-privileged foothold on that machine first, so systems with no local user access risk less. Remote attackers without a local account cannot use this flaw directly.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["foglightfordatabases","fordatabases"],"ptokens":["databases","foglight","for"],"labels":["databasemonitoring","high","questfoglight","vendor","windows"],"campaign_type":null,"first_public_at":"2026-11-04T00:17:31+00:00","kev":null,"cvss_vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"zdi-disclosures@trendmicro.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-92200","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-92200","severity":null,"published_at":"2026-11-04T00:17:31+00:00","modified_at":"2026-11-04T00:17:31+00:00","first_seen_at":"2026-11-04T00:46:19+00:00","fetched_at":"2026-11-04T00:46:19+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-92200:1598","url":null,"severity":null,"published_at":"2026-11-04T00:51:28+00:00","modified_at":"2026-11-04T00:51:28+00:00","first_seen_at":"2026-11-04T00:51:28+00:00","fetched_at":"2026-11-04T00:51:28+00:00","note":"Read ZDI-26-865 (only source; reported to vendor 2026-07-10): says fixed in Foglight 8.3, folder path not named, affected range not given. No Quest vendor page found, so nothing marked verified. Not exploited per OffSeq/KEV."}],"documents":[{"id":62166,"url":"https://www.zerodayinitiative.com/advisories/ZDI-26-865/","title":"ZDI-26-865: Quest Foglight for Databases Incorrect Permission Assignment LPE","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}