Foglight for Databases CVE-2026-92200

Exploitation requires that Quest Foglight for Databases be installed (the flaw is in the product installer, which assigns incorrect permissions to a folder it creates) AND that the attacker already possess the ability to run low-privileged code on that same host (AV:L, PR:L). These two prerequisites are the primary limiting factors: there is no remote, unauthenticated, or network path, and user interaction is not required (UI:N). The exact folder, the writable permission condition, and how the product consumes the planted content are not described in the available sources, so whether a non-default configuration is needed cannot be confirmed.

This is a locally-exploitable privilege escalation (CVSS:3.0 AV:L/AC:L/PR:L/UI:N) scoring 7.8, driven entirely by high confidentiality, integrity, and availability impact (C:H/I:H/A:H) achieved by escalating to SYSTEM - not by ease of initial access. The vector confirms the attacker must already hold low-privileged code execution on the host (AV:L, PR:L), so this is a second-stage escalation primitive rather than a remote entry point. Signal completeness is limited: no EPSS score, no KEV listing, and no confirmed public exploit were provided, so widespread opportunistic exploitation cannot be inferred. The vuln.today decision label is 'this_week,' indicating meaningful but non-emergency priority, consistent with a local-only, authentication-requiring flaw. The lone reference is the ZDI advisory (ZDI-26-865, formerly ZDI-CAN-31118); this is a coordinated-disclosure advisory, not verified working exploit code. Net: a genuine privilege-escalation risk on hosts where Foglight is installed and where attackers can already run low-privileged code, but absent EPSS/KEV/POC evidence it is a patch-this-week issue rather than a mass-exploitation emergency.

An attacker who has already gained low-privileged code execution on a host running Quest Foglight for Databases abuses incorrect permissions on a product folder created by the installer - for example, replacing or planting a file that the product later executes in a SYSTEM context. This yields arbitrary code execution as SYSTEM, fully compromising the host. No public exploit was identified at time of analysis, and the local attack vector requires prior foothold on the machine.