Quest Foglight for Databases has been found to contain multiple vulnerabilities, disclosed on November 3, 2026. These vulnerabilities include both local and remote attack vectors, potentially impacting the security of systems using this software.
Among the disclosed vulnerabilities, ZDI-26-863 allows local attackers to escalate privileges due to a hard-coded encryption key. Another local vulnerability, ZDI-26-865, involves privilege escalation through incorrect permission assignment.
Remote vulnerabilities include ZDI-26-853, which allows attackers to disclose sensitive information with authentication, and ZDI-26-866, which enables remote code execution, also requiring authentication. Notably, ZDI-26-851 allows remote code execution without needing authentication.
All vulnerabilities were reported to Quest before their public disclosure. Exploitation of these vulnerabilities has been reported, highlighting the need for users to be aware of the potential risks.