Quest Foglight CVE-2026-92186

Exploitation requires the attacker to possess valid authenticated access to the Quest Foglight for Databases application (CVSS PR:L) and network reachability to the management interface; from there they reach the paFnUploadFileAndCreateInfo script and supply a crafted, unvalidated file path to trigger the directory traversal. No non-default configuration, special feature toggle, or user interaction is identified in the available sources as a prerequisite - the limiting factor is the authentication requirement (low-privilege account needed), not a specific deployment mode. The description does not state which SAPIs, versions, or configurations are affected, so per-version applicability is unverified.

This is a genuine high-priority issue rather than an inflated CVSS score, though not an immediate emergency. The supplied CVSS 3.0 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 8.8) describes a network-reachable, low-complexity flaw requiring only low-level authentication (PR:L) and no user interaction, yielding full confidentiality, integrity and availability impact - consistent with the description's claim of arbitrary code execution in the context of SYSTEM. The vuln.today decision label is 'this_week', indicating prompt but not emergency remediation. Key exploitation signals are MISSING and should temper urgency: there is no EPSS probability, no CISA KEV listing, and no confirmed public exploit in the provided data. The only reference is the ZDI advisory (ZDI-26-858) that disclosed the issue, not working exploit code. The authentication requirement (PR:L) is the main mitigating factor and suggests this is not a trivially mass-exploitable internet worm candidate, but post-authentication RCE as SYSTEM on a database-monitoring platform is a serious privilege-escalation and lateral-movement risk once any foothold exists. No signals conflict with each other; rather, the picture is a credible, well-characterized ZDI-reported RCE lacking (so far) evidence of active or automated exploitation.

An attacker who already holds valid low-privilege credentials to a Quest Foglight for Databases installation sends a crafted request to the paFnUploadFileAndCreateInfo script supplying a malicious user-controlled path. Because the path is not properly validated before file operations, the attacker writes a file to an attacker-chosen location and achieves arbitrary code execution running as SYSTEM. No public exploit code is identified in the available data; the ZDI advisory documents the flaw but is not verified working exploit code.