ZDI 2026-11-03

ZDI-26-859: Quest Foglight for Databases runScript Incorrect Authorization Remote Code Execution Vulnerability

CVE-2026-92191

Machine-generated analysis · WAYSCloud LLM

Remote attackers can execute arbitrary code via the runScript function after authenticating.

Context

Quest Foglight for Databases is affected. The advisory describes an incorrect authorization issue in the runScript feature that enables remote code execution. Exploitation requires valid authentication credentials.

Operator considerations

Check: Verify that the runScript endpoint is restricted to authorized users only.
Isolate: Isolate the Foglight service if unauthorized runScript activity is detected.
Log: Enable detailed logging of runScript invocations to monitor for suspicious use.

From Zero Day Initiative ↗

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Quest Foglight for Databases. Authentication is required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 8.8. The following CVEs are assigned: CVE-2026-92191.

Read the full advisory on ZDI →