Quest Foglight CVE-2026-92192

Exploitation requires valid authentication to the Quest Foglight for Databases management interface (CVSS PR:L), after which the attacker invokes the installLicense script with a maliciously crafted, user-supplied path that is used in file operations without proper validation (CWE-22 directory traversal). The limiting factor is the authentication requirement - this is not a pre-auth flaw; an attacker must first obtain or possess account access. The upside for the attacker, and the reason impact is rated high, is that the vulnerable installLicense operation executes in the SYSTEM context, so a successful traversal escalates to full host compromise. No user interaction is required (UI:N), and the vector is network-reachable (AV:N) against the application's licensing functionality.

The CVSS 3.0 base score of 8.8 (AV:N/AC:L/PR:L/UI:N) describes a network-reachable, low-complexity flaw requiring some authentication (PR:L) that yields full confidentiality, integrity, and availability impact - consistent with code execution in the SYSTEM context per the ZDI advisory. No EPSS score, CISA KEV listing, or working proof-of-concept is present in the supplied data, so there is no public exploit identified at time of analysis; the single reference is the ZDI advisory (ZDI-26-855), which documents the finding but is not exploit code. The vuln.today decision label is 'this_week,' indicating elevated but not emergency urgency, which is coherent with a high-severity but not-yet-exploited bug. The key tension to flag: the CVSS vector specifies S:U (scope unchanged) and PR:L, yet the description states code runs as SYSTEM while the attacker is an authenticated (presumably lower-privileged) user - that privilege crossing arguably warrants scope-change (S:C) consideration; verify the authorization model with Quest. Net: a real priority for environments running Foglight for Databases, but the absence of active-exploitation and PoC signals means it is a patch-this-cycle item rather than a drop-everything emergency.

An attacker who already holds valid (low-privilege) credentials to a Quest Foglight for Databases installation submits a crafted path to the installLicense script, which fails to validate the user-supplied path before performing file operations. Because the operation runs in the SYSTEM context, the traversal lets the attacker write to or manipulate a file location that results in arbitrary code execution as SYSTEM. No public exploit code is identified at time of analysis; only the ZDI advisory is available.