Foglight for Databases CVE-2026-92198

Exploitation requires network reachability to the affected installation's getSource method, which accepts and parses an attacker-supplied XML document; the vulnerable XML parser does not restrict external entity (XXE) references, so a crafted document specifying a URI causes server-side retrieval and disclosure. Per the description and the PR:N/UI:N vector, no authentication and no user interaction are needed, and exploitation works against the application's standard processing path - there is no stated requirement for a non-default feature or configuration toggle. The practical LIMITING factor is that the attacker must be able to reach the getSource interface on the network; what an attacker can disclose (local files versus internal HTTP/other-protocol targets reachable via SSRF) depends on the parser's permitted URI schemes and the host's network position, and the exact fixed version / affected version range is not stated in the available sources.

This is a credible, actionable issue rather than an inflated high-CVSS score. The CVSS 3.0 vector (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L, base 8.2) describes an unauthenticated, network-reachable, low-complexity flaw with no user interaction and high confidentiality impact - the hardest prerequisites to satisfy are already absent, which is what elevates real-world concern for an XXE/server-side-request bug. The vuln.today decision label is 'this_week', consistent with a serious-but-not-emergency priority. However, several signals are MISSING from the input and must not be presented as present: no EPSS exploitation-probability score is provided, the CVE is NOT on CISA KEV, no SSVC 'automatable/technical impact' breakdown is supplied, and no public exploit or PoC reference is listed (the only reference is the ZDI advisory itself, which is an advisory, not exploit code). So current status is: no public exploit identified at time of analysis, and no evidence of active exploitation. One minor internal tension worth noting: the description characterizes the flaw as enabling 'arbitrary server-side requests' (SSRF-like behavior that can reach other systems), yet the supplied vector uses S:U (scope unchanged) and A:L; defenders relying on scope should verify the blast radius with Quest, since SSRF reaching internal services can effectively cross a trust boundary even when the parser itself only returns disclosed content. Net: treat as a near-term remediation priority driven by the unauthenticated/high-confidentiality profile, while acknowledging that quantitative exploitation likelihood (EPSS) and exploit maturity are unknown from the provided data.

A remote, unauthenticated attacker sends a crafted XML document to the getSource method of an internet- or network-reachable Foglight for Databases installation. Because external entity references are not restricted, the XML parser resolves an attacker-specified URI and embeds the retrieved content back into the document, allowing the attacker to read local files or force server-side requests to internal resources and recover their contents in the application's response. No authentication and no user interaction are required (AV:N/AC:L/PR:N/UI:N); no public exploit code was identified in the provided data.