Foglight for Databases CVE-2026-92185

Exploitation requires the attacker to deliver a crafted XML document - one declaring an external entity that points to an attacker-chosen URI - to the component backed by the AbstractParser class, which then resolves the URI and embeds its contents during processing. Per the CVSS vector (PR:N/UI:N) and the description, no authentication and no user interaction are required, so default exposure of the XML-accepting interface is the only real prerequisite. The exact endpoint, SAPI, or feature that routes input to AbstractParser is not described in the available sources, so which interfaces are reachable in a given deployment is unverified. Limiting factors: impact is rated Low confidentiality (C:L), implying partial or constrained rather than full file disclosure, and the affected network service must be reachable by the attacker.

This is a genuine but mid-tier priority rather than an emergency. The CVSS 3.0 base score of 7.2 (High) rests on a favorable attacker profile - AV:N/AC:L/PR:N/UI:N means remote, low-complexity, unauthenticated exploitation with no user interaction, and the description independently confirms 'Authentication is not required.' The scope change (S:C) plus execution 'in the context of SYSTEM' is what elevates the score, yet the confidentiality impact is only Low (C:L) with no integrity impact (I:N) and only Low availability (A:L), indicating limited or partial data disclosure rather than full arbitrary file read - consistent with a constrained or blind XXE. The vuln.today decision label is 'this_week,' i.e. patch within the normal cycle, not act_now/emergency. Key corroborating signals are MISSING: no EPSS probability was supplied, there is no CISA KEV listing, and no confirmed public exploit is indicated - the sole reference is the ZDI coordinator advisory, not working exploit code. Net: credible unauthenticated remote XXE from a reputable reporter (Trend Micro ZDI), but constrained impact and absence of exploitation telemetry place it below act-now severity. No conflicting signals in the data, though the limited C:L rating versus 'SYSTEM context' wording is worth confirming against the vendor advisory for the actual scope of readable data.

A remote, unauthenticated attacker submits a crafted XML document containing an external entity that references an attacker-chosen URI to an endpoint handled by Foglight's AbstractParser. The parser resolves and embeds the referenced resource back into the document during processing, letting the attacker read sensitive content in the context of the SYSTEM account. No authentication or user interaction is needed; no verified public exploit code is identified at time of analysis.