Foglight for Databases CVE-2026-92199

Exploitation requires that the attacker can already run low-privileged code on the system hosting Quest Foglight for Databases (per CVSS PR:L and the advisory's explicit statement that the attacker 'must first obtain the ability to execute low-privileged code on the target system'). The specific weakness is a hard-coded cryptographic key used by the EncryptionUtil component's symmetricDecrypt method, so the condition is the presence of that fixed key in the shipped product rather than any opt-in feature or non-default setting. Limiting factors: the attack vector is local only (no network exploitation), it is authenticated to the extent that an existing low-privilege foothold is needed, and it affects installations of this specific Quest product; no remote or unauthenticated path is described in the available sources.

This is a credible but conditional priority, not an internet-facing emergency. The CVSS 3.0 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8 HIGH) describes a locally-exploitable flaw that requires the attacker to already hold low-privileged code execution on the host, so it is a post-compromise privilege-escalation primitive rather than an initial-access vulnerability. The impact ceiling is severe - full confidentiality, integrity and availability impact via arbitrary code execution as SYSTEM - which makes it a valuable second-stage step for an attacker who already has a foothold. No EPSS score, no CISA KEV listing, and no SSVC machine triage were supplied in the input, so widespread or automatable exploitation cannot be asserted; the only decision signal present is the vuln.today priority 'this_week', which indicates prompt but not emergency remediation. The sole reference is the ZDI advisory (ZDI-26-863), a coordinated-disclosure write-up reported by Trend Micro ZDI, not a published working exploit. Net: the low-complexity, no-interaction local escalation to SYSTEM warrants timely patching on any host running this product, but the local-only attack vector and the authenticated prerequisite bound the real-world risk below that of a remote unauthenticated flaw.

An attacker who has already obtained a low-privileged account or code-execution foothold on a server running Quest Foglight for Databases extracts the hard-coded cryptographic key embedded in the EncryptionUtil component and uses it against the symmetricDecrypt method to recover or forge protected data, escalating to arbitrary code execution in the SYSTEM context. Exploitation is local only and low-complexity (AV:L/AC:L) with no user interaction required. No public exploit code was identified in the provided data; the only reference is the ZDI advisory.