Quest Foglight CVE-2026-92187
HIGHAttack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate with low-privileged account
-
DeliverySubmit crafted path to extractAndCreateUploadInfoList
-
ExploitBypass path validation via directory traversal
-
ExecutionWrite file to attacker-chosen location
-
ImpactExecute arbitrary code as SYSTEM
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V5 - File Handling Path canonicalization, traversal prevention
MITRE ATT&CK
2 techniques across 2 tactics: Discovery, Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires an authenticated session on Quest Foglight for Databases (CVSS PR:L indicates low-privileged, authenticated access is needed - this is the primary limiting factor). The concrete prerequisite is reaching the extractAndCreateUploadInfoList method and supplying a crafted path containing directory-traversal sequences that the application fails to validate before performing file operations. No user interaction is required (UI:N) and the vector is network-based (AV:N). Attackers without any valid credentials cannot exploit this; the realistic risk therefore concentrates in deployments where low-privilege accounts are broadly provisioned or where credentials can be obtained. The exact request format and any configuration-mode dependency are not described in the available sources. |
| Impact | This is a credible near-term priority rather than a paper-high score. The provided CVSS 3.0 vector (AV:N/AC:L/PR:L/UI:N) describes a network-reachable, low-complexity flaw requiring only low-privileged authentication, with full H/H/H impact because successful exploitation yields code execution as SYSTEM - consistent with the 8.8 base score. The vuln.today decision label is 'this_week', which signals elevated-but-not-emergency urgency. Signals are incomplete: no EPSS exploitation-probability value is supplied, the vulnerability is NOT listed in CISA KEV (no confirmed active exploitation), and no confirmed working exploit code is indicated - only a ZDI advisory reference. CWE-22 directory traversal combined with file-write-style operations that lead to RCE is a well-understood and reliably exploitable pattern once an attacker is authenticated, so the main gating factor is the PR:L authentication requirement. Net: real priority for environments running the affected product, driven by SYSTEM-level impact and low attack complexity, but moderated by the authentication precondition and the absence of EPSS/KEV/public-exploit confirmation. |
| Exploit ScenarioDerived | An attacker who holds a low-privileged authenticated account on a Quest Foglight for Databases installation sends a request to the extractAndCreateUploadInfoList functionality containing a crafted file path with traversal sequences. Because the user-supplied path is not properly validated before use in file operations, the attacker writes or places a file outside the intended directory and achieves arbitrary code execution in the SYSTEM context. No public working exploit is confirmed; a ZDI advisory reference (ZDI-26-852 / ZDI-CAN-29039) documents the issue. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Nov 04, 2026
Authenticated directory traversal in Quest Foglight for Databases lets a low-privileged account pass a crafted path into the extractAndCreateUploadInfoList method and write files outside the intended upload location, which can be leveraged to execute arbitrary code as SYSTEM. The flaw is network-reachable with no user interaction required (CVSS 8.8, PR:L), so practical exposure is gated by possession of valid low-privilege credentials and is highest where such accounts are broadly provisioned. No public exploit code and no CISA KEV entry were identified in the available data at time of analysis.
RemediationAI
No vendor-released patch or fixed version is identified in the provided data, so consult the ZDI advisory ZDI-26-852 (https://www.zerodayinitiative.com/advisories/ZDI-26-852/) for the vendor's remediation guidance and exact fixed build numbers before treating any version as clean. Because exploitation requires a valid low-privilege session, the most directly effective interim control is to shrink the population of accounts that can reach the upload functionality: audit and remove unnecessary low-privilege Foglight accounts, enforce strong authentication and credential hygiene on the remaining ones, and monitor requests handled by extractAndCreateUploadInfoList for traversal sequences in path parameters. These measures reduce likelihood but do not remove the flaw; only a vendor fix that properly validates user-supplied paths addresses the root cause.
Affected ProductsAI
Quest Foglight for Databases is the affected product, per the ZDI disclosure ZDI-CAN-29039 published as ZDI-26-852 (https://www.zerodayinitiative.com/advisories/ZDI-26-852/). The provided intelligence does not include a version range or CPE identifier, so the specific vulnerable and fixed builds are not confirmed here; the affected component is the extractAndCreateUploadInfoList method used in the upload workflow. Until the vendor advisory enumerates fixed builds, any Foglight for Databases installation that exposes this authenticated upload functionality should be treated as potentially affected.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory, i.e. path traversal). The extractAndCreateUploadInfoList method constructs a file destination from user-supplied input without adequately validating or canonicalizing the path, so directory-traversal sequences can escape the intended upload directory; because the resulting write lands in an attacker-chosen location, it can be converted into code execution running as SYSTEM. The reported vector is CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, independently assessed as CVSS:3.1 with identical metrics - network-based, low complexity, low privileges required, no user interaction, scope unchanged, and high confidentiality, integrity and availability impact. The affected product is Quest Foglight for Databases, disclosed through Trend Micro's Zero Day Initiative as ZDI-CAN-29039 / ZDI-26-852; no CPE data was supplied, and the exact request format and any configuration-mode dependency are not described in the available sources.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Network-reachable, low-complexity path traversal needing a low-privileged account (PR:L) and no user interaction; code runs as SYSTEM yielding full C/I/A impact.
Primary rating from Vendor (trendmicro).
CVSS VectorVendor: trendmicro
DescriptionCVE.org
Quest Foglight for Databases extractAndCreateUploadInfoList Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Quest Foglight for Databases. Authentication is required to exploit this vulnerability.
The specific flaw exists within the extractAndCreateUploadInfoList method. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. Was ZDI-CAN-29039.
Executive ViewAI
Quest Foglight for Databases, a critical monitoring platform, contains a high-severity vulnerability that allows an authenticated low-privileged user to write arbitrary files and potentially execute code with SYSTEM privileges. This puts organizations at risk of full system compromise, especially where many users have low-privilege accounts. Leadership should prioritize remediation to prevent potential lateral movement and data breaches.
No vendor-released patch identified at time of analysis. Interim mitigations include restricting network access to trusted sources, enforcing least privilege by limiting low-privileged accounts, and monitoring for anomalous file writes or process creation on Foglight servers.
Threat Intelligence Overview
NVD
CVE.org
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Path traversal exploits occur when applications use user-controlled input to construct file system paths without proper validation.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
GitHub PoC
Exploit-DB