Skip to content
Critical RCE and LPE Vulnerabilities in Quest Foglight for Databases

Critical RCE and LPE Vulnerabilities in Quest Foglight for Databases

First seen 4 Nov 2026, 07:49 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •November 4, 2026 at 07:50 UTC

On November 3, 2026, the Zero Day Initiative disclosed multiple critical vulnerabilities in Quest Foglight for Databases, including six remote code execution (RCE) flaws and two local privilege escalation (LPE) vulnerabilities. The most severe RCE vulnerabilities, CVE-2026-92189 and CVE-2026-92190, allow unauthenticated attackers to execute arbitrary code with SYSTEM privileges, posing a significant risk to enterprises. The vulnerabilities were reported between April and July 2026 and have been addressed in version 8.3 of Foglight. Organizations are urged to upgrade immediately to mitigate the risks associated with these flaws. The vulnerabilities include improper validation of user-supplied data and incorrect permission assignments, which can lead to full system compromise. The presence of unauthenticated RCE vulnerabilities significantly lowers the barrier for threat actors, making immediate action necessary for affected systems.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated 2h ago How this analysis works

Timeline

2026-04-30
Vulnerabilities reported to vendor
Multiple vulnerabilities affecting Quest Foglight for Databases were reported between April and July 2026.
Zerodayinitiative
2026-11-03
Advisories published
The Zero Day Initiative published advisories for six vulnerabilities in Quest Foglight, including RCE and LPE issues.
Zerodayinitiative
2026-11-03
Patch released
Quest released version 8.3 of Foglight for Databases to address the disclosed vulnerabilities.
Qpulse.Quasarcybertech
2026-11-03
CVE-2026-92196 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-11-03
CVE-2026-92191 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-11-03
CVE-2026-92189 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-11-03
CVE-2026-92190 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-11-03
CVE-2026-92199 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-11-03
CVE-2026-92193 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE

More articles in this cluster (15)

Following this threat?

Track CVE-2026-92189 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (11)

1 / 3

Common questions

Which versions of Foglight are affected?
All versions prior to 8.3 of Quest Foglight for Databases are affected by the vulnerabilities.
What should organizations do now?
Organizations should upgrade to version 8.3 of Foglight immediately to mitigate the vulnerabilities.
Are these vulnerabilities being actively exploited?
No confirmed active exploitation has been reported, but the vulnerabilities are critical and should be patched promptly.