Quest Foglight for Databases getSource Flaw Enables Remote Information Disclosure
Original title: ZDI-26-864: Quest Foglight for Databases getSource XML External Entity Processing Information Disclosure Vulnerability
Remote attackers can initiate arbitrary server-side requests without authentication (CVE-2026-92198)
ZDI published an advisory describing a vulnerability in Quest Foglight for Databases. The flaw allows remote attackers to initiate arbitrary server-side requests on affected installations. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 8.2 and CVE-2026-92198.
- Remote information disclosure possible
- No authentication required
- CVSS 8.2
- Affects Quest Foglight for Databases
Impact: remote information disclosure
| Product | Affected |
|---|---|
| Quest Foglight for Databases | — |
- CVEs
- CVE-2026-92198
- Vendors
- Quest
- Products
- Foglight for Databases
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-92198 | XML External Entity Information Disclosure in Quest Foglight for Databases | 8.2 | — |
From the original article
This vulnerability allows remote attackers to initiate arbitrary server-side requests on affected installations of Quest Foglight for Databases. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 8.
zerodayinitiative.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.