Quest Foglight for Databases Hardcoded Encryption Key Allows Local Privilege Escalation
Local attackers can escalate privileges after obtaining low-privileged code execution (CVE-2026-92199)
50
CVE-2026-92199
Hardcoded Encryption Key LPE in Quest Foglight for Databases
- CVSS 3.0
- 7.8 high
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
The flaw is a hardcoded cryptographic key in EncryptionUtil.symmetricDecrypt in Quest Foglight for Databases. Local attackers who can execute low-privileged code can exploit this to escalate privileges to SYSTEM and run arbitrary code. Affected are installations where low-privileged execution is possible.
What to do: Apply Quest's update for CVE-2026-92199
| Product | Affected |
|---|---|
| Quest Foglight for Databases | — |
Estimated exposure
No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
Quest Foglight for Databases EncryptionUtil Hardcoded Encyption Key Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Quest Foglight for Databases. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the symmetricDecrypt method. The issue results from the use of a hard-coded cryptographic key. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-29967.
- Weakness
- CWE-321
- Vector
- CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H