---
id: "CVE-2026-92200"
kind: "vulnerability"
aliases: ["CVE-2026-92200"]
title: "Quest Foglight for Databases: folder permissions let local users gain SYSTEM"
severity: "high"
cvss: 7.8
epss: null
exploited: false
status: "open"
category: "vendor"
products: [{"name": "Foglight for Databases", "fixed": ["8.3"], "affected": "< 8.3 (exact lower bound not stated)", "ecosystem": "vendor"}]
ecosystems: []
tags: ["database-monitoring", "quest-foglight", "vendor", "windows"]
not_affected_if: ["no-local-untrusted-users", "not-installed"]
published_at: "2026-11-04T00:17:31+00:00"
first_seen_at: "2026-11-04T00:46:19+00:00"
updated_at: "2026-11-04T00:51:28+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-92200", "first_seen_at": "2026-11-04T00:46:19+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-11-04T00:51:28+00:00"}]
---

# Quest Foglight for Databases: folder permissions let local users gain SYSTEM

ZDI-26-865: the Foglight for Databases installer leaves incorrect permissions on a folder it uses. A local low-privileged user can abuse this to run code as SYSTEM. ZDI says it is fixed in Foglight 8.3. No exploitation or public PoC known.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Foglight for Databases affected < 8.3 (exact lower bound not stated) fixed 8.3

## How to check

- On Windows hosts, check the installed Foglight for Databases version (Programs and Features); versions before 8.3 are affected per ZDI.
- The advisory does not name the folder. Review ACLs on the Foglight install and installer directories (icacls) for write access by non-admin users; this path is unconfirmed.

## Fix

Upgrade to Foglight 8.3 (per ZDI-26-865; Quest's own advisory not found)

## Timeline

- 2026-11-04T00:46:19+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-92200
- 2026-11-04T00:51:28+00:00 analyst — Read ZDI-26-865 (only source; reported to vendor 2026-07-10): says fixed in Foglight 8.3, folder path not named, affected range not given. No Quest vendor page found, so nothing marked verified. Not exploited per OffSeq/KEV.

## Documents

- [advisory] ZDI-26-865: Quest Foglight for Databases Incorrect Permission Assignment LPE https://www.zerodayinitiative.com/advisories/ZDI-26-865/

## From the sources

Quest Foglight for Databases Incorrect Permission Assignment Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Quest Foglight for Databases. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.

The specific flaw exists within the product installer. The issue results from incorrect permissions on a folder used by the product. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-31118.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_