Read the docs
TI-2026-84904 Aliases CVE-2026-92198GHSA-xrxm-r7j2-xvh7

XML external entity injection in Quest Foglight for Databases

Priority MEDIUM 47CWE-611Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · None · Low
Fix status
No fix listed

Attack profile from CVSS 3.0 · CNA. Fix status from CNA.

Summary

Quest Foglight for Databases from 8.2.0 is affected. The getSource method does not properly restrict XML external entity references (CWE-611), so the XML parser fetches attacker-specified URIs and embeds their contents back into the document. A remote, unauthenticated attacker can trigger arbitrary server-side requests and disclose information in the application context.

Written with Claude Haiku 5.5 from the sources below · 2026-11-04

Description from the CNA

Quest Foglight for Databases getSource XML External Entity Processing Information Disclosure Vulnerability. This vulnerability allows remote attackers to initiate arbitrary server-side requests on affected installations of Quest Foglight for Databases. Authentication is not required to exploit this vulnerability. The specific flaw exists within the getSource method. Due to the improper restriction of XML External Entity (XXE) references, a crafted document specifying a URI causes the XML parser to access the URI and embed the contents back into the XML document for further processing. An attacker can leverage this vulnerability to disclose information in the context of the application. Was ZDI-CAN-29934.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.02798 86th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
QuestFoglight for Databases8.2.0—No fix listedCNA
  • Foglight for Databases VendorQuest Affected 8.2.0 Fixed in — No fix listed CNA

Remediation

The sources list no fixed version for Quest Foglight for Databases.

Written with Claude Haiku 5.5 from the sources below · 2026-11-04

Timeline

  1. 2026-11-04 Threatist record created from CVE-2026-92198
  2. 2026-11-04 Alias added: GHSA-xrxm-r7j2-xvh7
  3. 2026-11-06 CISA SSVC decision points changed

References

Other 1

  • TI-2025-23985 Quest KACE Systems Management Appliance (SMA) 13.0.x before 13.0.385, 13.1.x before… KEVCVSS 3.1CRITICAL 10.0
  • TI-2018-07906 The '/common/download_agent_installer.php' script in the Quest KACE System Management… KEVCVSS 3.1CRITICAL 9.8
  • TI-2012-04921 The Annotation Objects Extension ActiveX control in AnnotateX.dll in Quest InTrust… CVSS 2.0HIGH 10.0
  • TI-2018-01077 Stack-based buffer overflow in Quest NetVault Backup CVSS 3.0CRITICAL 9.8
  • TI-2017-12724 SQL injection in Quest NetVault Backup CVSS 3.0CRITICAL 9.8
  • TI-2017-04330 Buffer Overflow in Quest One Identity Privilege Manager for Unix before 6.0.0.061 allows… CVSS 3.0CRITICAL 9.8
See all 166 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences