Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Buy Us a Coffee

CVE-2026-92191— Quest Foglight for Databases runScript Incorrect Authorization Remote Code Execution Vulnerability

Quick assessment

Affected

Quest Foglight for Databases

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Quest Foglight for Databases 的 runScript 功能存在授权不当导致的远程代码执行漏洞。该漏洞允许远程攻击者在受影响的 Quest Foglight for Databases 安装实例上执行任意代码。利用此漏洞需要预先通过身份认证。具体缺陷存在于 runScript 函数中，问题源于在允许访问相关功能之前未进行正确的授权检查。攻击者可利用此漏洞以 SYSTEM 上下文执行代码。该漏洞编号为 ZDI-CAN-29192。

AI Predicted 8.8 Difficulty: Easy Updated Nov 04, 2026

Possible ATT&CK Techniques 2 AI

T1055.001 · Dynamic-link Library Injection T1190 · Exploit Public-Facing Application

Updated Nov 04, 2026

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Quest Foglight for Databases runScript Incorrect Authorization Remote Code Execution Vulnerability

Source: CVE Program / CVE List V5

Vulnerability Description

Quest Foglight for Databases runScript Incorrect Authorization Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Quest Foglight for Databases. Authentication is required to exploit this vulnerability. The specific flaw exists within the runScript function. The issue results from incorrect authorization prior to allowing access to functionality. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. Was ZDI-CAN-29192.

Source: CVE Program / CVE List V5

CVSS Information

N/A

Source: CVE Program / CVE List V5

Vulnerability Type

授权机制不正确

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
Quest	Foglight for Databases	8.2.0	-

II. Public POCs for CVE-2026-92191

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-92191

请登录查看更多情报信息。

Other References for CVE-2026-92191 (1)

https://www.zerodayinitiative.com/advisories/ZDI-26-859/ x_research-advisory

https://www.cve.org/CVERecord?id=CVE-2026-92191

Same Patch Batch · Quest · 2026-11-03 · 16 CVEs total

CVE-2026-92197		Quest Foglight for Databases unzipFile Directory Traversal Remote Code Execution Vulnerabi
CVE-2026-92198		Quest Foglight for Databases getSource XML External Entity Processing Information Disclosu
CVE-2026-92189		Quest Foglight for Databases writeTopologySectionToFile External Control of File Path Remo
CVE-2026-92199		Quest Foglight for Databases EncryptionUtil Hardcoded Encyption Key Local Privilege Escala
CVE-2026-92193		Quest Foglight for Databases FileServlet External Control of File Path Information Disclos
CVE-2026-92192		Quest Foglight for Databases installLicense Directory Traversal Remote Code Execution Vuln
CVE-2026-92200		Quest Foglight for Databases Incorrect Permission Assignment Local Privilege Escalation Vu
CVE-2026-92195		Quest Foglight for Databases loadEvolveLicense Directory Traversal Remote Code Execution V
CVE-2026-92186		Quest Foglight for Databases paFnUploadFileAndCreateInfo Directory Traversal Remote Code E
CVE-2026-92188		Quest Foglight for Databases ForgeMBeanServerSupport Missing Authentication Remote Code Ex
CVE-2026-92190		Quest Foglight for Databases baseRmiServiceExporter Deserialization of Untrusted Data Remo
CVE-2026-92194		Quest Foglight for Databases loadManageServerLicense Directory Traversal Remote Code Execu
CVE-2026-92185		Quest Foglight for Databases AbstractParser XML External Entity Processing Information Dis
CVE-2026-92196		Quest Foglight for Databases renderTemplateString Server-Side Template Injection Remote Co
CVE-2026-92187		Quest Foglight for Databases extractAndCreateUploadInfoList Directory Traversal Remote Cod

IV. Related Vulnerabilities

Same product: Foglight for Databases

Same vendor: Quest

Same weakness: CWE-863