Path Traversal in Quest Foglight for Databases (CVE‑2026‑92193) Enables Sensitive File Disclosure
What It Is — Quest Foglight for Databases contains an insecure FileServlet implementation that fails to validate a user‑supplied file path before performing file‑system operations. An authenticated remote attacker can craft a request that traverses directories and reads arbitrary files with SYSTEM privileges, exposing potentially sensitive configuration or data. The flaw is tracked as CVE‑2026‑92193, carries a CVSS 6.5 (Medium) score, and was patched in Foglight 8.3. No public exploits have been observed, but the advisory notes that exploitation is feasible once valid credentials are obtained.
Affected Products — Quest Foglight for Databases (all versions prior to 8.3).
Why It Matters for Trust & Control Assurance — The issue highlights the control objective of enforcing robust input validation and file‑access safeguards, a single control that maps to many frameworks (e.g., NIST CSF 2.0 Protect).
Recommended Actions
- Upgrade to Foglight 8.3 or later immediately.
- Review any custom extensions or integrations that invoke the FileServlet for proper path sanitization.
- Capture the patch deployment as audit evidence and update your control‑mapping repository.
Source: Zero Day Initiative advisory