Quest Foglight CVE-2026-92197
HIGHAttack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate with low-privileged account
-
DeliverySubmit crafted path to unzipFile
-
ExploitTraversal escapes intended directory
-
ExecutionWrite file to attacker-controlled location
-
ImpactExecute arbitrary code as SYSTEM
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V5 - File Handling Path canonicalization, traversal prevention
MITRE ATT&CK
2 techniques across 2 tactics: Discovery, Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires an authenticated session on Quest Foglight for Databases (CVSS PR:L confirms a low-privileged account is needed), after which the attacker reaches the unzipFile method and supplies a path that is not validated before being used in file operations, enabling directory traversal and file write leading to code execution as SYSTEM. The primary limiting factor is the authentication requirement - anonymous unauthenticated attackers cannot trigger it - while no user interaction is needed (UI:N) and attack complexity is low (AC:L). The specific product feature exposed is the unzipFile archive-extraction/file-handling path; the exact interface (API endpoint or UI function) that reaches it is not detailed in the available sources. |
| Impact | This is a credible, high-priority vulnerability but not an emergency. The CVSS 3.0 vector (AV:N/AC:L/PR:L/UI:N) describes network-reachable exploitation with low attack complexity and no user interaction, requiring only low-level privileges (PR:L), yielding full confidentiality, integrity, and availability impact (C:H/I:H/A:H) with code execution in the context of SYSTEM - a severity of 8.8 that the ZDI assessment and the 'this_week' priority label corroborate. The authentication requirement (PR:L) is the single most important risk-limiting factor: an attacker must already hold a valid, albeit low-privileged, account on the Foglight instance, which narrows the realistic threat to insiders, credential-theft scenarios, or chained post-authentication attacks rather than fully anonymous internet-wide exploitation. No EPSS score is provided in the input, so exploitation probability cannot be quantified. No CISA KEV listing is present and no SSVC automatable/technical-impact decision is supplied beyond the vendor-channel 'this_week' label, so there is no evidence of active exploitation. The only reference is the Zero Day Initiative advisory (ZDI-26-860), which is a disclosure advisory, not verified working exploit code. In summary: a genuinely dangerous post-authentication RCE with SYSTEM impact warranting prompt patching, but the authentication precondition and absence of KEV/EPSS/public exploit signals place it below drop-everything emergency status. |
| Exploit ScenarioDerived | An attacker holding a low-privileged authenticated account on a Quest Foglight for Databases installation submits a crafted archive or request to the vulnerable unzipFile method containing a path-traversal sequence in a user-supplied path. Because the path is used in file operations without proper validation, the attacker writes a malicious file to an attacker-chosen location, leading to arbitrary code execution in the context of SYSTEM. No public exploit is identified in the provided data; only the ZDI disclosure advisory is referenced. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Nov 04, 2026
Authenticated directory traversal in Quest Foglight for Databases lets a low-privileged user bypass the intended extraction directory in the unzipFile method and write files to arbitrary locations, ultimately yielding code execution in the SYSTEM context. The flaw is rated CVSS 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), so it is network-reachable and needs no user interaction, but a valid account is mandatory - anonymous attackers cannot trigger it. Reported through Trend Micro ZDI as ZDI-CAN-29901 / ZDI-26-860, it is not listed in CISA KEV and no public exploit code or proof-of-concept was identified at time of analysis; the priority signal places it in the this_week remediation window rather than an emergency.
RemediationAI
No vendor-released patch or fixed version is identified in the available sources, so the first step is to confirm the current status directly with Quest and review ZDI-26-860 (https://www.zerodayinitiative.com/advisories/ZDI-26-860/) for any vendor-supplied update; if Quest publishes a patched build, upgrade to that exact version as soon as it is available. Until then, the decisive control is the authentication prerequisite: audit every Foglight for Databases account, remove or disable dormant and unnecessary users, and restrict the low-privileged accounts that could reach the unzipFile functionality - this shrinks the pool of credentials an attacker would need but does nothing against a compromised legitimate account. Because exploitation ends in a file write, additionally tighten write permissions on the Foglight installation and web-application directories so the service account cannot drop executable content outside its own working paths (this may break legitimate deployment or plug-in tasks and should be validated in a test instance first), and monitor for unexpected archive uploads and new files appearing under application or web-served directories.
Affected ProductsAI
Quest Foglight for Databases is the affected product; the vulnerability resides in its unzipFile archive-handling method. No version ranges, fixed-version thresholds, or CPE identifiers were included in the supplied intelligence, so the precise set of vulnerable builds cannot be stated here - administrators should determine exposure by comparing their installed release against the vendor advisory referenced by the disclosure, Zero Day Initiative advisory ZDI-26-860 at https://www.zerodayinitiative.com/advisories/ZDI-26-860/ (tracked as ZDI-CAN-29901). Any Foglight for Databases deployment that exposes the unzipFile extraction path to authenticated users should be treated as potentially affected until the vendor confirms otherwise.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is a classic CWE-22 path traversal in the archive-extraction logic of Quest Foglight for Databases - specifically the unzipFile method, which takes a caller-supplied path and performs file operations on it without validating that the resulting destination stays inside the intended directory. Because the destination is attacker-influenced, a crafted path can escape the extraction root and plant files wherever the service account has write access; since Foglight runs with SYSTEM privileges, that file write becomes arbitrary code execution at the highest local privilege level. No CPE data was supplied with this record, so the exact affected build range cannot be enumerated from the available sources, and the specific interface that reaches unzipFile (an API endpoint versus a UI function) is likewise not detailed in the advisory. The relevant qualifier on the CVSS vector is PR:L, which confirms an authenticated, low-privileged session is the only stated precondition; AC:L and UI:N indicate no special conditions or victim interaction beyond that.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Network-reachable (AV:N) with low complexity (AC:L); PR:L because a low-privileged authenticated account is required; SYSTEM-level code execution gives full C:H/I:H/A:H, scope unchanged.
Primary rating from Vendor (trendmicro).
CVSS VectorVendor: trendmicro
DescriptionCVE.org
Quest Foglight for Databases unzipFile Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Quest Foglight for Databases. Authentication is required to exploit this vulnerability.
The specific flaw exists within the unzipFile method. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. Was ZDI-CAN-29901.
Executive ViewAI
Quest Foglight for Databases contains a high-severity directory traversal vulnerability that allows an authenticated low-privileged user to write files to arbitrary locations, leading to code execution with SYSTEM privileges. This puts sensitive database monitoring data and underlying systems at risk, and leadership should prioritize remediation within the week due to the potential for privilege escalation and system compromise.
No vendor-released patch identified at time of analysis. Interim mitigations include restricting network access to Foglight, enforcing least privilege on user accounts, and monitoring for anomalous file writes.
Threat Intelligence Overview
NVD
CVE.org
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Path traversal exploits occur when applications use user-controlled input to construct file system paths without proper validation.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
GitHub PoC
Exploit-DB