{"id":"CVE-2026-92188","kind":"vulnerability","aliases":["CVE-2026-92188"],"related":[],"title":"Quest Foglight for Databases: unauthenticated remote code execution via ForgeMBeanServerSupport","description":"Quest Foglight for Databases ForgeMBeanServerSupport Missing Authentication Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Quest Foglight for Databases. Authentication is not required to exploit this vulnerability.\n\nThe specific flaw exists within the ForgeMBeanServerSupport module. The issue results from the lack of authentication prior to allowing access to functionality. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. Was ZDI-CAN-29168.","summary":"Quest Foglight for Databases has a flaw in its ForgeMBeanServerSupport module that lets remote attackers reach functionality without logging in. An attacker who exploits it can execute arbitrary code as SYSTEM on the affected server.","severity":"critical","cvss":9.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Foglight for Databases","fixed":["8.3"],"affected":"< 8.3","ecosystem":"vendor"}],"ecosystems":[],"tags":["database-monitoring","missing-authentication","other","quest-foglight","rce","self-hosted","windows"],"not_affected_if":["not-installed"],"how_to_check":"Check the installed Foglight for Databases version in the management server UI or installer; anything below 8.3 should be treated as exposed (range inferred from ZDI's 'fixed in 8.3'). Also check whether the Foglight management server is reachable from untrusted networks; the sources do not name the port.","fix":"Upgrade Foglight for Databases to 8.3 (per ZDI-26-854; Quest's own advisory not located)","status":"open","published_at":"2026-11-04T00:17:29+00:00","first_seen_at":"2026-11-04T00:46:18+00:00","triaged_at":"2026-11-04T00:47:34+00:00","updated_at":"2026-11-04T00:50:27+00:00","category":"other","confidence":0.7,"triage":{"at":"2026-11-04T00:47:34Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Quest Foglight for Databases: unauthenticated remote code execution via ForgeMBeanServerSupport","impact":"high","summary":"Quest Foglight for Databases has a flaw in its ForgeMBeanServerSupport module that lets remote attackers reach functionality without logging in. An attacker who exploits it can execute arbitrary code as SYSTEM on the affected server.","audience":"businesses","category":"other","nicknames":[],"who_cares":["quest-foglight","windows","database-monitoring"],"confidence":0.7,"fix_status":"unknown","needs_auth":"no","worst_case":"Remote attacker runs arbitrary code as SYSTEM on the monitoring server","analyst_note":"Find the affected and fixed Foglight for Databases versions and the vendor advisory; the ZDI advisory (ZDI-CAN-29168) and the NVD entry are the only sources cited.","how_to_check":"- Check whether Quest Foglight for Databases is installed on the server, and which version it runs; the sources do not name affected version ranges, so `unknown`.\n- Confirm whether the Foglight for Databases service is reachable from networks beyond the monitoring server; the sources do not say which port or interface the module listens on, so `unknown`.","plain_action":"","needs_analyst":true,"not_affected_if":["not-installed"],"who_is_affected":"Organizations running Quest Foglight for Databases, the database monitoring product, are exposed. The sources do not state which versions are affected or which network interface the ForgeMBeanServerSupport module listens on, so exposure beyond installations reachable from the network is unknown. Teams that do not run Foglight for Databases can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000739,"input_tokens":4230,"output_tokens":632,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Find the affected and fixed Foglight for Databases versions and the vendor advisory; the ZDI advisory (ZDI-CAN-29168) and the NVD entry are the only sources cited.","search":"'-2026':12A,15A '-92188':13A,16A '29168':146C 'access':125C 'affect':68B,91C 'allow':83C,124C 'arbitrari':62B,88C 'attack':49B,56B,85C,129C 'authent':25B,76C,98C,121C 'code':7A,63B,78C,89C,136C 'context':139C 'cve':11A,14A 'databas':4A,21B,38B,73C,97C 'database-monitor':20B 'databases':19A 'execut':8A,61B,79C,87C,135C 'exist':109C 'exploit':58B,103C 'flaw':41B,108C 'foglight':2A,17A,29B,36B,71C,95C 'for':18A 'forgembeanserversupport':10A,44B,74C,112C 'function':51B,127C 'host':33B 'instal':92C 'issu':115C 'lack':119C 'let':47B 'leverag':131C 'log':53B 'miss':24B,75C 'missing-authent':23B 'modul':45B,113C 'monitor':22B 'prior':122C 'quest':1A,28B,35B,70C,94C 'quest-foglight':27B 'rce':30B 'reach':50B 'remot':6A,48B,77C,84C 'requir':101C 'result':116C 'self':32B 'self-host':31B 'server':69B 'specif':107C 'system':65B,141C 'unauthent':5A 'via':9A 'vulner':80C,82C,105C,133C 'window':34B 'within':110C 'without':52B 'zdi':144C 'zdi-can':143C","nicknames":[],"mitigations":[],"who_affected":"Self-hosted Foglight for Databases servers on Windows, where the flaw lets an attacker with no login run code as SYSTEM. ZDI lists the affected product as Foglight for Databases and says it is fixed in 8.3; earlier versions are presumed affected. Teams not running Foglight for Databases can skip this. Limiting network access to the server reduces exposure until you upgrade.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["foglightfordatabases","fordatabases"],"ptokens":["databases","foglight","for"],"labels":["critical","databasemonitoring","missingauthentication","other","questfoglight","rce","selfhosted","windows"],"campaign_type":null,"first_public_at":"2026-11-04T00:17:29+00:00","kev":null,"cvss_vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"zdi-disclosures@trendmicro.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-92188","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-92188","severity":null,"published_at":"2026-11-04T00:17:29+00:00","modified_at":"2026-11-04T00:17:29+00:00","first_seen_at":"2026-11-04T00:46:18+00:00","fetched_at":"2026-11-04T00:46:18+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-92188:1595","url":null,"severity":null,"published_at":"2026-11-04T00:50:27+00:00","modified_at":"2026-11-04T00:50:27+00:00","first_seen_at":"2026-11-04T00:50:27+00:00","fetched_at":"2026-11-04T00:50:27+00:00","note":"ZDI-26-854 (9.8, reported 2026-04-30, public 2026-11-03) says fixed in Foglight 8.3. Quest's 8.3.0 release notes (July 2026) do not mention this CVE and I found no Quest advisory, so nothing is marked verified. The affected range below 8.3 is inferred from the fix line. No exploitation or PoC reported."}],"documents":[{"id":62159,"url":"https://www.zerodayinitiative.com/advisories/ZDI-26-854/","title":"ZDI-26-854 Quest Foglight for Databases ForgeMBeanServerSupport Missing Authentication RCE","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}