Quest Foglight for Databases Vulnerable to RCE via File Path Manipulation
A critical vulnerability in Quest Foglight for Databases allows unauthenticated attackers to achieve remote code execution by exploiting an external control of file path flaw.
The Zero Day Initiative (ZDI) has disclosed a critical remote code execution (RCE) vulnerability, tracked as ZDI-26-861, affecting Quest Foglight for Databases. This flaw, assigned a CVSS score of 9.8, allows unauthenticated attackers to execute arbitrary code on vulnerable systems.
The vulnerability stems from an issue within the writeTopologySectionToFile method. Specifically, the software fails to properly validate a user-supplied path before using it in file operations. This lack of input sanitization enables an attacker to manipulate file paths, leading to the execution of malicious code in the context of the SYSTEM user.
Exploitation of this vulnerability does not require any form of authentication, making it particularly dangerous. An attacker could potentially gain complete control over a compromised Foglight for Databases installation, allowing them to access sensitive data, disrupt operations, or use the system as a pivot point for further network intrusions.
Quest has addressed this vulnerability by releasing Foglight version 8.3. Users are strongly advised to update to this patched version as soon as possible to mitigate the risk of exploitation. The ZDI coordinated the public release of this advisory on November 3, 2026, following their standard disclosure timeline after reporting the vulnerability to the vendor on April 30, 2026.
This vulnerability highlights a common class of security flaws related to improper handling of file paths and user-supplied input. Such vulnerabilities can have severe consequences, especially in software that runs with elevated privileges, as is often the case with database management and monitoring tools like Foglight.
Organizations relying on Quest Foglight for Databases should prioritize applying the available patch. Proactive security measures, including regular vulnerability scanning and timely patching, are crucial for maintaining a strong security posture against such threats. The high CVSS score indicates a significant risk, and prompt action is warranted.
This new advisory, ZDI-26-859, details a separate remote code execution vulnerability within Quest Foglight for Databases, specifically in the runScript function. Unlike the previously reported file path manipulation flaw, this vulnerability requires prior authentication and stems from incorrect authorization checks, allowing attackers to execute code in the context of SYSTEM with a CVSS score of 8.8.