Quest Foglight CVE-2026-92191

Exploitation requires the attacker to possess valid authenticated access to Quest Foglight for Databases (CVSS PR:L confirms low-privilege credentials are needed) and to reach the runScript function, where authorization is incorrectly enforced before access is granted. The vulnerability is network-reachable with no user interaction and low attack complexity (AV:N/AC:L/UI:N). The primary limiting factor is the authentication requirement - an attacker must already hold a low-privileged Foglight account - which scopes realistic risk toward malicious insiders or credential-theft follow-on activity rather than fully unauthenticated internet exploitation. Any specific configuration or deployment mode required beyond possessing an account is not described in the available sources.

This is a serious, actionable vulnerability that should be prioritized, though it is not a drop-everything emergency. The CVSS 3.0 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, score 8.8) indicates remote exploitation over the network with low attack complexity, no user interaction, and only low privileges required, yielding full confidentiality, integrity, and availability impact - and the ZDI advisory states code executes in the context of SYSTEM, which is a severe outcome. The vuln.today decision label is 'this_week', consistent with a high-severity but not actively-exploited issue. No EPSS score was provided in the input, so exploitation probability cannot be quantified here. The vulnerability is NOT listed in CISA KEV and there is no public exploit identified at time of analysis; the only reference is the ZDI advisory (ZDI-26-859), which documents the issue but is not verified working exploit code. The principal limiting factor is that authentication is required (PR:L): an attacker must already hold a valid, low-privileged Foglight account, which constrains exposure to insiders or attackers who have obtained credentials. There is no signal conflict in the data; the main gap is the absence of EPSS and any independent exploitation reporting.

An attacker who has obtained a low-privileged authenticated session on a Quest Foglight for Databases installation invokes the runScript function, which fails to properly authorize the request before granting access. Because the flaw is network-reachable with low complexity and no user interaction, the attacker leverages this incorrect authorization to execute arbitrary code in the context of SYSTEM. No public exploit code is identified at time of analysis; the trigger beyond 'incorrect authorization prior to allowing access to the runScript functionality' is not detailed in the available sources.