Quest Foglight for Databases External File Path Control Remote Code Execution (CVE-2026-92189)

The ZDI advisory ZDI-26-861 says the flaw exists within the writeTopologySectionToFile method. It "results from the lack of proper validation of a user-supplied path prior to using it in file operations." ZDI rates the flaw CVSS 3.0 9.8 Critical, and the record says no authentication is needed.

From a Chosen Path to Running Code

The record does not walk through the attack, so this part is our explanation of the class. When software lets a caller pick where a file goes, the caller can aim a write at a place the system later loads or runs. A file written there can then execute with the rights of the service.

ZDI puts those rights at SYSTEM, so a successful write could lead to full control of the host. The name of the method suggests it writes a section of topology data to a file, but that is only our reading of the name.

What to Look for on a Host

A path flaw leaves files behind, which is its one useful trait for defenders. We recommend listing files created or changed under the Foglight installation and in startup or scheduled locations since the product was last upgraded. Treat an unfamiliar executable or script written by the Foglight service as a sign of compromise.

The record does not say which directories the method can reach. Our least privilege entry explains why a service account that cannot write to program folders limits this kind of bug.

Signals for CVE-2026-92189

We checked these public signals on 4 November 2026 and name the source of each one.

The same product has two more disclosures from the same day, a missing authentication flaw and a deserialization flaw. Our remote code execution glossary entry covers how these flaws end in code execution.

The CVE record lists a single affected version for this flaw, 8.2.0, and gives all other versions the status unknown. The ZDI page names the product but no version.

The ZDI-26-861 page says "Fixed in Foglight 8.3." That is the only fix information in the primary sources we read, so we do not name a hotfix or a build number. The siblings CVE-2026-92188 and CVE-2026-92190 carry the same fix line.

If your servers run an older build, plan the move to 8.3 as one change that closes all three. Our patch management entry describes how to schedule it.