CVE-2026-92199High· 7.8▾ Abyssal0dayQuest Foglight for Databases EncryptionUtil Hardcoded Encyption Key Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Quest Foglight for Databases. An …
▾ Abyssal zone — Critical with a public exploit or in-the-wild use
impact 42.9 · likelihood 0 · exploitation 25
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.08%
Quest Foglight for Databases EncryptionUtil Hardcoded Encyption Key Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Quest Foglight for Databases. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
The specific flaw exists within the symmetricDecrypt method. The issue results from the use of a hard-coded cryptographic key. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-29967.
foglight_for_databases 8.2.0Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-92196High· 7.2Quest Foglight for Databases renderTemplateString Server-Side Template Injection Remote Code Execution Vulnerability
CVE-2026-92198High· 8.2Quest Foglight for Databases getSource XML External Entity Processing Information Disclosure Vulnerability
CVE-2026-92200High· 7.8Quest Foglight for Databases Incorrect Permission Assignment Local Privilege Escalation Vulnerability
CVE-2026-92185High· 7.2Quest Foglight for Databases AbstractParser XML External Entity Processing Information Disclosure Vulnerability
CVE-2026-92189Critical· 9.8Quest Foglight for Databases writeTopologySectionToFile External Control of File Path Remote Code Execution Vulnerability
CVE-2026-92191High· 8.8Quest Foglight for Databases runScript Incorrect Authorization Remote Code Execution Vulnerability