Skip to content
NewA calmer, faster ZeroHour
StoryVulnerabilitycritical

ZDI Publishes Multiple Advisories for Quest Foglight for Databases Vulnerabilities

1 source · 16 articlesFirst reported Updated ()
What's new

First merged summary.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

ZDI disclosed ten vulnerabilities in Quest Foglight for Databases, including unauthenticated RCE flaws and directory traversals.

ZDI published multiple advisories detailing flaws in Quest Foglight for Databases that enable remote code execution. Several flaws allow unauthenticated attacks with CVSS scores of 9.8, while others require authentication. Issues include missing authentication, directory traversal, deserialization, and XML external entity processing. One local privilege escalation was noted. The vulnerabilities affect Quest Foglight for Databases installations, with no patches mentioned.

Key facts
  • Unauthenticated RCE via missing auth (CVE-2026-92188, CVSS 9.8)
  • Directory traversal RCE (CVE-2026-92195, CVE-2026-92192, CVSS 8.8)
  • Deserialization RCE (CVE-2026-92190, CVSS 9.8)
  • External file path control RCE (CVE-2026-92189, CVSS 9.8)
  • XML external entity disclosure (CVE-2026-92198, CVSS 8.2)
  • Local privilege escalation (CVE-2026-92199, CVSS 7.8)
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

Timeline

dated events in the reporting · oldest first
  1. Nov 3, 2026ZDI publishes ZDI-26-854 for Quest Foglight missing auth RCE · ZDI Published Advisories
  2. Nov 3, 2026ZDI publishes ZDI-26-856 for Quest Foglight directory traversal RCE · ZDI Published Advisories
  3. Nov 3, 2026ZDI publishes ZDI-26-855 for Quest Foglight installLicense traversal · ZDI Published Advisories
  4. Nov 3, 2026ZDI publishes ZDI-26-861 for Quest Foglight external file path control · ZDI Published Advisories
  5. Nov 3, 2026ZDI publishes ZDI-26-851 for Quest Foglight deserialization RCE · ZDI Published Advisories
  6. Nov 3, 2026ZDI publishes ZDI-26-864 for Quest Foglight XML external entity disclosure · ZDI Published Advisories

What each outlet adds

beyond the shared facts
  • ZDI Published AdvisoriesDisclosed 10 CVEs across Quest Foglight for Databases with RCE and traversal flaws
CVEs
CVE-2026-92188CVE-2026-92195CVE-2026-92192CVE-2026-92189CVE-2026-92190CVE-2026-92198CVE-2026-92186CVE-2026-92199CVE-2026-92191CVE-2026-92187CVE-2026-92194CVE-2026-92193
Vendors
Quest
Products
Foglight for Databases

Coverage

oldest first · one row per article · UTC
  1. · 1d ago ZDI Published AdvisoriesFirst report

    Quest Foglight for Databases installLicense directory traversal enables remote code execution

    InstallLicense directory traversal flaw allows remote arbitrary code execution; authentication required.

  2. · 1d ago ZDI Published Advisories

    Quest Foglight for Databases AbstractParser Flaw Enables Remote Information Disclosure

    Remote attackers can disclose sensitive information without authentication (CVE-2026-92185)

  3. · 1d ago ZDI Published Advisories

    Quest Foglight for Databases Hardcoded Encryption Key Allows Local Privilege Escalation

    Local attackers can escalate privileges after obtaining low-privileged code execution (CVE-2026-92199)

  4. · 1d ago ZDI Published Advisories

    Quest Foglight for Databases runScript incorrect authorization RCE

    ZDI-26-859 CVSS 8.8 flaw allows remote code execution on authenticated Quest Foglight for Databases

  5. · 1d ago ZDI Published Advisories

    Quest Foglight for Databases directory traversal enables remote code execution

    Authentication required to exploit the directory traversal flaw in Quest Foglight for Databases.

  6. · 1d ago ZDI Published Advisories

    Quest Foglight for Databases permission assignment flaw enables local privilege escalation

    Local privilege escalation vulnerability in Quest Foglight for Databases.

  7. · 1d ago ZDI Published Advisories

    Quest Foglight for Databases directory traversal enables remote code execution

    Directory traversal vulnerability allows remote attackers to execute arbitrary code; authentication is required.

  8. · 1d ago ZDI Published Advisories

    Quest Foglight for Databases Deserialization Flaw Enables Remote Code Execution

    Unauthenticated remote attackers can execute arbitrary code in Quest Foglight for Databases via a deserialization vulnerability (CVE-2026-92190).

  9. · 1d ago ZDI Published Advisories

    Quest Foglight for Databases loadManageServerLicense directory traversal RCE

    ZDI-26-857 CVSS 8.8 flaw allows remote code execution on authenticated Quest Foglight for Databases

  10. · 1d ago ZDI Published Advisories

    Quest Foglight for Databases missing authentication enables remote code execution

    ForgeMBeanServerSupport flaw enables unauthenticated remote code execution on Quest Foglight for Databases.

  11. · 1d ago ZDI Published Advisories

    Quest Foglight for Databases getSource Flaw Enables Remote Information Disclosure

    Remote attackers can initiate arbitrary server-side requests without authentication (CVE-2026-92198)

  12. · 1d ago ZDI Published Advisories

    Quest Foglight for Databases template injection enables remote code execution

    Server-side template injection in Quest Foglight for Databases allows remote code execution.

  13. · 1d ago ZDI Published Advisories

    Quest Foglight for Databases FileServlet path disclosure vulnerability

    FileServlet external control of file path information disclosure allows sensitive data exposure.

  14. · 1d ago ZDI Published Advisories

    Quest Foglight for Databases writeTopologySectionToFile Flaw Enables Remote Code Execution

    Remote attackers can execute arbitrary code without authentication (CVE-2026-92189)

  15. · 1d ago ZDI Published Advisories

    Quest Foglight for Databases unzipFile directory traversal RCE

    ZDI-26-860 CVSS 8.8 flaw allows remote code execution on authenticated Quest Foglight for Databases

  16. · 1d ago ZDI Published Advisories

    Quest Foglight for Databases paFnUploadFileAndCreateInfo directory traversal RCE

    ZDI-26-858 CVSS 8.8 flaw allows remote code execution on authenticated Quest Foglight for Databases

Vulnerabilities in this story

All
CVEVulnerabilityCVSSEPSSSignalsPublished
CVE-2026-92188
+11 related CVEs
CVE-2026-92189CVE-2026-92190CVE-2026-92187CVE-2026-92186CVE-2026-92191CVE-2026-92192CVE-2026-92194CVE-2026-92195CVE-2026-92198CVE-2026-92199CVE-2026-92193
Missing Authentication RCE in Quest Foglight for Databases ForgeMBeanServerSupport
9.8
group max
—