Quest Foglight for Databases CVE-2026-92195

Exploitation requires an authenticated session on Quest Foglight for Databases (CVSS PR:L indicates a low-privileged account suffices) with network reachability to the Foglight interface exposing the loadEvolveLicense script. The concrete prerequisite is the ability to invoke loadEvolveLicense with an attacker-controlled path, which is not validated before use in a file operation (CWE-22); no user interaction and no non-default configuration are indicated (UI:N, AC:L). The principal limiting factor is the authentication requirement - an attacker must first obtain valid credentials or an active session - which prevents fully unauthenticated external exploitation; once authenticated, the path to SYSTEM-level code execution is low-complexity. Exact affected and fixed versions are not provided in the available data.

This is a credible near-term priority driven by impact and simplicity of the attack rather than by confirmed exploitation. The CVSS 3.0 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 8.8) describes a network-reachable, low-complexity flaw needing only low privileges and no user interaction, yielding full confidentiality, integrity, and availability loss - and the description states code runs in the context of SYSTEM, so successful exploitation is a complete host compromise. The vuln.today decision label is this_week, consistent with a serious but not actively-exploited issue. No EPSS score, no CISA KEV listing, and no confirmed public exploit code are present in the input; the sole reference is the Zero Day Initiative advisory (ZDI-26-856, ZDI-CAN-29232), which is a vendor/researcher disclosure, not verified working exploit code. The one meaningful limiter is PR:L: an attacker must already hold a valid low-privileged authenticated session on the Foglight instance, which constrains purely external opportunistic attacks. No signals are in direct conflict; the main gap is the absence of exploitation-probability data (EPSS) and KEV status, so prioritization rests on the high technical impact and the SYSTEM-level outcome rather than on evidence of in-the-wild use.

An attacker with a valid low-privileged Foglight account sends a crafted request to the loadEvolveLicense script containing a traversal sequence in the user-supplied path, causing a file operation to act outside the intended directory and resulting in code execution as SYSTEM. Because the CVSS vector is AV:N/AC:L/PR:L/UI:N, this requires only network access and authentication with no victim interaction and low attack complexity. No confirmed public exploit code is identified; only the ZDI advisory reference exists.