Quest Foglight for Databases Vulnerable to Directory Traversal Leading to RCE
A directory traversal vulnerability in Quest Foglight for Databases allows authenticated attackers to execute arbitrary code with SYSTEM privileges.
The Zero Day Initiative (ZDI) has disclosed a critical remote code execution (RCE) vulnerability affecting Quest Foglight for Databases. Identified as ZDI-26-852, this flaw allows authenticated attackers to gain SYSTEM-level privileges on vulnerable installations.
The vulnerability stems from an improper validation of user-supplied paths within the extractAndCreateUploadInfoList method. This oversight enables attackers to manipulate file operations, effectively performing directory traversal. By exploiting this, an attacker can overwrite critical system files or place malicious executables in locations that allow for arbitrary code execution in the context of the SYSTEM user.
This vulnerability requires prior authentication to be exploited. However, once authenticated, an attacker can leverage the directory traversal to achieve a high level of system compromise. The CVSS score assigned to this vulnerability is 8.8, underscoring its critical nature and the significant risk it poses to organizations using Quest Foglight for Databases.
Quest has addressed this vulnerability in Foglight version 8.3. Users are strongly advised to update to this patched version as soon as possible to mitigate the risk of exploitation. The disclosure timeline indicates that the vulnerability was reported to the vendor on May 21, 2026, with a coordinated public release of the advisory on November 3, 2026.
Quest Foglight for Databases is a performance monitoring tool used by organizations to manage and optimize database environments. Its critical role in monitoring sensitive database infrastructure makes vulnerabilities within it particularly concerning. Successful exploitation could lead to complete system takeover, data breaches, or the disruption of critical database operations.
This advisory serves as a reminder of the importance of timely patching and secure configuration for all software, especially those managing critical infrastructure. The requirement for authentication does not diminish the severity, as compromised credentials or internal access can provide the necessary foothold for attackers.
Organizations utilizing Quest Foglight for Databases should prioritize updating their systems to version 8.3 or later. Additionally, reviewing access controls and monitoring for any suspicious activity related to the extractAndCreateUploadInfoList method can provide an early warning of potential exploitation attempts.
This advisory, ZDI-26-858, details a directory traversal vulnerability within the paFnUploadFileAndCreateInfo script of Quest Foglight for Databases. Unlike previously reported issues, this specific flaw requires authentication to exploit and allows for remote code execution in the context of the SYSTEM user, carrying a CVSS score of 8.8.
This new advisory, ZDI-26-855, details a directory traversal vulnerability within the installLicense script of Quest Foglight for Databases. While the previously reported vulnerability (CVE-2026-92192) also involves directory traversal and requires authentication, this specific advisory highlights that the exploit allows for remote code execution in the context of SYSTEM privileges. The vulnerability was fixed in Foglight version 8.3.
This new advisory, ZDI-26-856, details a directory traversal vulnerability within the loadEvolveLicense script of Quest Foglight for Databases. Unlike some previously disclosed flaws, this specific vulnerability requires authentication to exploit and allows for remote code execution in the context of SYSTEM. The Zero Day Initiative has assigned it a CVSS score of 8.8.
This advisory, ZDI-26-860, details a directory traversal vulnerability within the unzipFile method of Quest Foglight for Databases. Unlike some previously disclosed flaws, this specific vulnerability requires authentication to exploit and allows for remote code execution in the context of the SYSTEM user. The Zero Day Initiative has assigned a CVSS score of 8.8 to this flaw.
This new advisory, ZDI-26-866, details a distinct server-side template injection vulnerability within the renderTemplateString method of Quest Foglight for Databases. Unlike the directory traversal flaw in the existing story, this vulnerability requires authentication and allows remote attackers to execute arbitrary code in the context of SYSTEM by exploiting improper validation of user-supplied strings before template engine processing. The Zero Day Initiative has assigned this new flaw a CVSS score of 7.2.