Quest Foglight CVE-2026-92189

No special conditions beyond network reachability - the CVSS vector (AV:N/AC:L/PR:N/UI:N) and the ZDI description both state authentication is not required, so a remote unauthenticated attacker can exploit a reachable Foglight for Databases installation. The concrete prerequisite is the ability to invoke the writeTopologySectionToFile method, whose user-supplied file path is used in file operations without proper validation (CWE-73). The main limiting factor is network exposure: the attacker must be able to reach the Foglight for Databases service/management interface; the available data does not describe any required non-default configuration or feature toggle, nor a specific affected version range, so reachability and affected-version scope should be confirmed against the vendor advisory.

All available severity signals point the same direction and reinforce one another. The CVSS 3.0 vector (AV:N/AC:L/PR:N/UI:N) describes a network-reachable, low-complexity, unauthenticated flaw with full High impact to confidentiality, integrity and availability, scoring 9.8, and the ZDI description independently confirms the three features that make that score credible: no authentication required, trivial triggering via an externally controlled file path (CWE-73), and code execution in the context of SYSTEM. The vuln.today Decision label is act_now, which is consistent with an unauthenticated SYSTEM-level RCE. However, the exploitation-maturity signals are thin: there is no EPSS probability in the input, no CISA KEV listing, and no public exploit or working-PoC reference - the single reference is the ZDI advisory itself, not exploit code. So this is a genuine high priority on intrinsic severity (unauthenticated remote RCE as SYSTEM in an enterprise monitoring product), but there is currently no evidence of active or at-scale exploitation; treat the urgency as driven by the act_now decision and the severity, not by observed in-the-wild activity. One data note: the supplied vector is CVSS 3.0, not 3.1, and no affected/fixed version range accompanies it, so scope of affected installs should be verified against the Quest advisory.

A remote, unauthenticated attacker reaches the Foglight for Databases service over the network and invokes the writeTopologySectionToFile method with a crafted, attacker-controlled destination path. Because the path is not validated, the attacker writes attacker-chosen content to an arbitrary location, leading to code execution in the SYSTEM context. No public exploit code is identified in the available data; the only reference is the ZDI advisory.