Quest Foglight CVE-2026-92196

Exploitation requires the attacker to be an authenticated, high-privilege user of Quest Foglight for Databases (CVSS PR:H) with network access to the web interface, and to be able to supply a user-controlled string that reaches the renderTemplateString method, which processes it through the template engine without proper validation. The limiting factor is the privileged-authentication prerequisite - there is no unauthenticated or low-privilege path described, and no user interaction by a victim is needed (UI:N). The specific product feature or screen that exposes renderTemplateString, and any configuration that gates it, are not detailed in the available sources.

This is a moderate-priority, not emergency, issue. The vuln.today decision label is 'this_week', consistent with a serious-but-gated flaw. The CVSS 3.0 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, base 7.2) describes network-reachable, low-complexity exploitation that nonetheless requires high privileges (PR:H) - i.e. an already-authenticated, privileged Foglight user. That authentication gate is the single biggest factor lowering real-world risk: this is not a pre-auth internet-spray bug. Offsetting that, the technical impact is maximal - arbitrary code execution in the context of SYSTEM via server-side template injection (CWE-1336) - so a successful exploit is a full host compromise, and an insider or an attacker who has already phished/obtained a privileged account gains complete control. No EPSS score was provided, so exploitation probability cannot be quantified. The CVE is NOT listed in CISA KEV and there is no confirmed active exploitation. The only reference is the ZDI advisory (ZDI-26-866, formerly ZDI-CAN-29889), which is a coordinated-disclosure write-up, not published exploit code. Net: a genuinely high-impact RCE whose real-world urgency is tempered by the PR:H authentication requirement and the absence of any exploitation or in-the-wild signal.

An attacker who already holds a high-privilege authenticated account on Quest Foglight for Databases (for example a rogue administrator, or an outsider who has compromised such credentials) submits a crafted string to functionality that reaches the renderTemplateString method. Because the input is passed to the template engine without proper validation, the payload is evaluated server-side and runs arbitrary code as SYSTEM. No public exploit code is identified at time of analysis; only the ZDI advisory describing the flaw exists.