Quest Foglight for Databases Vulnerable to Information Disclosure via XXE
A critical XML External Entity (XXE) vulnerability in Quest Foglight for Databases allows unauthenticated remote attackers to disclose sensitive information.
Quest Foglight for Databases has been found to contain a critical information disclosure vulnerability, tracked as ZDI-26-862, which can be exploited by unauthenticated remote attackers. The flaw resides within the AbstractParser class and stems from an improper restriction of XML External Entity (XXE) references.
When processing a crafted XML document that specifies a Uniform Resource Identifier (URI), the XML parser incorrectly accesses this URI and embeds its contents back into the XML document for further processing. This behavior allows an attacker to manipulate the parser into accessing and revealing sensitive information from the system's context. The Zero Day Initiative has assigned this vulnerability a CVSS score of 7.2, highlighting its significant risk.
Exploitation of this vulnerability does not require any prior authentication, meaning any attacker with network access to an affected Foglight instance could potentially leverage this flaw. The ability to disclose information in the context of SYSTEM could lead to the exposure of highly sensitive configuration details, credentials, or other critical data residing on the server.
This vulnerability affects Quest Foglight for Databases. While the specific versions impacted are not detailed in the advisory, users are strongly advised to ensure their installations are updated. The issue has been fixed in Foglight version 8.3.
The disclosure timeline indicates that the vulnerability was first reported to the vendor on June 9, 2026. Following coordinated public release of the advisory on November 3, 2026, the advisory was updated on the same day. This coordinated disclosure process allows vendors time to develop and release patches before the vulnerability details become widely known.
This XXE vulnerability is particularly concerning due to its potential to bypass security controls and exfiltrate sensitive data without requiring authentication. Organizations relying on Quest Foglight for Databases should prioritize applying the available patch to mitigate the risk of information disclosure and potential further compromise.
While this advisory focuses on information disclosure, XXE vulnerabilities can sometimes be chained with other flaws to achieve more severe impacts, such as remote code execution or denial of service, depending on the specific XML parser implementation and the application's context. Therefore, prompt patching is crucial.
The Zero Day Initiative has updated its advisory for this Quest Foglight for Databases vulnerability, assigning it a CVSS score of 8.2 and detailing that the flaw exists within the getSource method. This XML External Entity Processing flaw requires no authentication to exploit and allows remote attackers to initiate arbitrary server-side requests.