Quest Foglight CVE-2026-92194

Exploitation requires an authenticated session to Quest Foglight for Databases (CVSS PR:L - a valid low-privileged account), after which the attacker reaches the loadManageServerLicense script over the network (AV:N) with no user interaction (UI:N) and low complexity (AC:L). The concrete prerequisite is the ability to supply a path value to the loadManageServerLicense functionality; the flaw is the lack of proper validation of that user-supplied path before it is used in file operations, enabling directory traversal. The principal limiting factor is the authentication requirement - an attacker must already possess credentials or a session - so the exposure is bounded by how broadly Foglight accounts are issued and whether the management interface is network-exposed. Successful exploitation yields code execution as SYSTEM.

This is a credible, above-average priority issue rather than an inflated high-CVSS score. The CVSS 3.0 vector (AV:N/AC:L/PR:L/UI:N) describes a network-reachable, low-complexity flaw requiring only low-level authentication, and the outcome is code execution in the context of SYSTEM (C:H/I:H/A:H) - a privilege escalation to the highest OS context on the host, which is what drives the 8.8 score. The vuln.today decision label is 'this_week', consistent with a serious but not actively-exploited bug. No EPSS probability was supplied, so widespread-exploitation likelihood cannot be quantified from this data. KEV status is not present (no CISA listing), and no public exploit or SSVC decision framework data was provided; the only reference is the ZDI advisory itself. The main caveat: exploitation is authenticated (PR:L), which meaningfully narrows the attacker population to those who already hold at least a low-privileged Foglight account, so this is best treated as a privilege-escalation-to-SYSTEM risk behind the authentication boundary rather than a fully unauthenticated internet-facing RCE.

An attacker holding a low-privileged authenticated session to Quest Foglight for Databases sends a crafted request to the loadManageServerLicense script supplying a manipulated file path. Because the user-supplied path is not properly validated before use in file operations, the attacker performs a directory traversal that leads to arbitrary code execution as SYSTEM. No public exploit code was identified at time of analysis; the only reference is the ZDI advisory.