CVE-2026-92194: Quest Foglight for Databases loadManageServerLicense Directory Traversal Remote Code Execution Vulnerability
Quest Foglight for Databases loadManageServerLicense Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Quest Foglight for Databases. Authentication is required to exploit this vulnerability.
The specific flaw exists within the loadManageServerLicense script. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. Was ZDI-CAN-29231.
Event History
Frequently Asked Questions
What level of access does an attacker need to exploit this issue?
The attacker must authenticate to the affected Quest Foglight for Databases installation. No user interaction is required once the attacker has the necessary authenticated access.
What is the likely impact of successful exploitation?
An attacker can execute arbitrary code in the context of SYSTEM, giving them high-impact control over the affected host, including confidentiality, integrity, and availability consequences.
What component should defenders investigate?
The flaw is in the loadManageServerLicense script, where a user-supplied path is not properly validated before it is used in file operations. Review access to this functionality and any related path input handling.