Quest vulnerabilities
We track 34 vulnerabilities in Quest products across 4 products. 34 are rated high or critical, and 2 have been exploited in real attacks. The most recent was published on November 12, 2026.
Latest Quest vulnerabilities
- 7.5 High severity
NetVault Backup: Integer Underflow (Wrap or Wraparound)
Quest NetVault Backup nvpmgr Integer Underflow Denial-of-Service Vulnerability. This vulnerability allows remote attackers to create a denial-of-service condition on affected installations of Quest NetVault Backup. Authentication is not required to exploit thi
- 7.5 High severity
NetVault Backup: Numeric Truncation Error
Quest NetVault Backup StnzCreateKey Numeric Truncation Error Denial-of-Service Vulnerability. This vulnerability allows remote attackers to create a denial-of-service condition on affected installations of Quest NetVault Backup. Authentication is not required
- 7.8 High severity
Foglight for Databases: Incorrect Permission Assignment for Critical Resource
Quest Foglight for Databases Incorrect Permission Assignment Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Quest Foglight for Databases. An attacker must first obtain the
- 7.8 High severity
Foglight for Databases: Use of Hard-coded Cryptographic Key
Quest Foglight for Databases EncryptionUtil Hardcoded Encyption Key Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Quest Foglight for Databases. An attacker must first obt
- 8.2 High severity
Foglight for Databases: Improper Restriction of XML External Entity Reference
Quest Foglight for Databases getSource XML External Entity Processing Information Disclosure Vulnerability. This vulnerability allows remote attackers to initiate arbitrary server-side requests on affected installations of Quest Foglight for Databases. Authent
- 8.8 High severity
Foglight for Databases: Improper Limitation of a Pathname to a Restricted Directory
Quest Foglight for Databases unzipFile Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Quest Foglight for Databases. Authentication is required to exploi
- 7.2 High severity
Foglight for Databases: Improper Neutralization of Special Elements Used in a Template Engine
Quest Foglight for Databases renderTemplateString Server-Side Template Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Quest Foglight for Databases. Authentication
- 8.8 High severity
Foglight for Databases: Improper Limitation of a Pathname to a Restricted Directory
Quest Foglight for Databases loadEvolveLicense Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Quest Foglight for Databases. Authentication is required t
- 8.8 High severity
Foglight for Databases: Improper Limitation of a Pathname to a Restricted Directory
Quest Foglight for Databases loadManageServerLicense Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Quest Foglight for Databases. Authentication is requ
- 8.8 High severity
Foglight for Databases: Improper Limitation of a Pathname to a Restricted Directory
Quest Foglight for Databases installLicense Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Quest Foglight for Databases. Authentication is required to e
- 8.8 High severity
Foglight for Databases: Incorrect Authorization
Quest Foglight for Databases runScript Incorrect Authorization Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Quest Foglight for Databases. Authentication is required to ex
- 9.8 Critical severity
Foglight for Databases: Deserialization of Untrusted Data
Quest Foglight for Databases baseRmiServiceExporter Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Quest Foglight for Databases. Authentic
- 9.8 Critical severity
Foglight for Databases: External Control of File Name or Path
Quest Foglight for Databases writeTopologySectionToFile External Control of File Path Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Quest Foglight for Databases. Authentic
- 9.8 Critical severity
Foglight for Databases: Missing Authentication for Critical Functionality
Quest Foglight for Databases ForgeMBeanServerSupport Missing Authentication Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Quest Foglight for Databases. Authentication is n
- 8.8 High severity
Foglight for Databases: Improper Limitation of a Pathname to a Restricted Directory
Quest Foglight for Databases extractAndCreateUploadInfoList Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Quest Foglight for Databases. Authentication
- 8.8 High severity
Foglight for Databases: Improper Limitation of a Pathname to a Restricted Directory
Quest Foglight for Databases paFnUploadFileAndCreateInfo Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Quest Foglight for Databases. Authentication is
- 7.2 High severity
Foglight for Databases: Improper Restriction of XML External Entity Reference
Quest Foglight for Databases AbstractParser XML External Entity Processing Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Quest Foglight for Databases. Authenticat
- 8.8 High severity
NetVault Backup: Improper Neutralization of Special Elements used in an OS Command
Quest NetVault Backup NVBULogDaemon Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Quest NetVault Backup. Although authentication is required to exploit t
- 8.8 High severity
NetVault Backup: Improper Neutralization of Special Elements used in an SQL Command
Quest NetVault Backup NVBUDashboard SQL Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Quest NetVault Backup. Although authentication is required to exploit this
- 8.8 High severity
NetVault Backup: Improper Neutralization of Special Elements used in an SQL Command
Quest NetVault Backup NVBULibrarySlot SQL Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Quest NetVault Backup. Although authentication is required to exploit thi
- 8.8 High severity
NetVault Backup: Improper Neutralization of Special Elements used in an SQL Command
Quest NetVault Backup NVBULibraryPort SQL Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Quest NetVault Backup. Although authentication is required to exploit thi
- 8.8 High severity
NetVault Backup: Improper Neutralization of Special Elements used in an SQL Command
Quest NetVault Backup NVBURemovableMedia SQL Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Quest NetVault Backup. Although authentication is required to exploit
- 8.8 High severity
NetVault Backup: Improper Neutralization of Special Elements used in an SQL Command
Quest NetVault Backup NVBUDeviceDrive SQL Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Quest NetVault Backup. Although authentication is required to exploit thi
- 8.8 High severity
NetVault Backup: Improper Neutralization of Special Elements used in an SQL Command
Quest NetVault Backup NVBURASDevice SQL Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Quest NetVault Backup. Although authentication is required to exploit this
- 8.8 High severity
NetVault Backup: Improper Neutralization of Input During Web Page Generation
Quest NetVault Backup addclient3 Cross-Site Scripting Authentication Bypass Vulnerability. This vulnerability allows remote attackers to bypass authentication on affected installations of Quest NetVault Backup. User interaction is required to exploit this vuln
- 8.8 High severity
NetVault Backup: Improper Neutralization of Special Elements used in an SQL Command
Quest NetVault Backup NVBUDashboard SQL Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Quest NetVault Backup. Although authentication is required to exploit this
- 8.8 High severity
NetVault Backup: Improper Neutralization of Input During Web Page Generation
Quest NetVault Backup viewclient Cross-Site Scripting Authentication Bypass Vulnerability. This vulnerability allows remote attackers to bypass authentication on affected installations of Quest NetVault Backup. User interaction is required to exploit this vuln
- 9.3 Critical severity
KACE Systems Management Appliance: Incorrect Authorization
The agent in Quest KACE Systems Management Appliance (SMA) before 14.0.97 and 14.1.x before 14.1.19 potentially allows privilege escalation on managed systems.
- 10.0 Critical severity
Quest KACE Systems Management Appliance (SMA) Improper Authentication Exploited
Quest KACE Systems Management Appliance (SMA) 13.0.x before 13.0.385, 13.1.x before 13.1.81, 13.2.x before 13.2.183, 14.0.x before 14.0.341 (Patch 5), and 14.1.x before 14.1.101 (Patch 4) contains an authentication bypass vulnerability that allows attackers to
- 7.8 High severity
kace_systems_management_appliance: Improper Limitation of a Pathname to a Restricted Directory
An issue was discovered in Quest KACE Agent for Windows 12.0.38 and 13.1.23.0. An unquoted Windows search path vulnerability exists in the KSchedulerSvc.exe and AMPTools.exe components. This allows local attackers to execute code of their choice with NT Author
- 7.8 High severity
kace_systems_management_appliance: Improper Limitation of a Pathname to a Restricted Directory
An issue was discovered in Quest KACE Agent for Windows 12.0.38 and 13.1.23.0. An Arbitrary file delete vulnerability exists in the KSchedulerSvc.exe component. Local attackers can delete any file of their choice with NT Authority\SYSTEM privileges.
- 9.8 Critical severity
Kace Systems Management Appliance: Inadequate Encryption Strength
In Quest KACE Systems Management Appliance (SMA) through 12.0, a hash collision is possible during authentication. This may allow authentication with invalid credentials.
- 9.8 Critical severity
Kace Systems Management Appliance: Improper Neutralization of Special Elements used in an SQL Command
A SQL injection vulnerability exists within Quest KACE Systems Management Appliance (SMA) through 12.0 that can allow for remote code execution via download_agent_installer.php.
- 9.8 Critical severity
Quest KACE System Management Appliance Remote Command Execution Exploited
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by anonymous users and can be abused to execute arbitrary commands on the system.