---
id: "CVE-2026-92188"
kind: "vulnerability"
aliases: ["CVE-2026-92188"]
title: "Quest Foglight for Databases: unauthenticated remote code execution via ForgeMBeanServerSupport"
severity: "critical"
cvss: 9.8
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "Foglight for Databases", "fixed": ["8.3"], "affected": "< 8.3", "ecosystem": "vendor"}]
ecosystems: []
tags: ["database-monitoring", "missing-authentication", "other", "quest-foglight", "rce", "self-hosted", "windows"]
not_affected_if: ["not-installed"]
published_at: "2026-11-04T00:17:29+00:00"
first_seen_at: "2026-11-04T00:46:18+00:00"
updated_at: "2026-11-04T00:50:27+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-92188", "first_seen_at": "2026-11-04T00:46:18+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-11-04T00:50:27+00:00"}]
---

# Quest Foglight for Databases: unauthenticated remote code execution via ForgeMBeanServerSupport

Quest Foglight for Databases has a flaw in its ForgeMBeanServerSupport module that lets remote attackers reach functionality without logging in. An attacker who exploits it can execute arbitrary code as SYSTEM on the affected server.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Foglight for Databases affected < 8.3 fixed 8.3

## How to check

Check the installed Foglight for Databases version in the management server UI or installer; anything below 8.3 should be treated as exposed (range inferred from ZDI's 'fixed in 8.3'). Also check whether the Foglight management server is reachable from untrusted networks; the sources do not name the port.

## Fix

Upgrade Foglight for Databases to 8.3 (per ZDI-26-854; Quest's own advisory not located)

## Timeline

- 2026-11-04T00:46:18+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-92188
- 2026-11-04T00:50:27+00:00 analyst — ZDI-26-854 (9.8, reported 2026-04-30, public 2026-11-03) says fixed in Foglight 8.3. Quest's 8.3.0 release notes (July 2026) do not mention this CVE and I found no Quest advisory, so nothing is marked verified. The affected range below 8.3 is inferred from the fix line. No exploitation or PoC reported.

## Documents

- [advisory] ZDI-26-854 Quest Foglight for Databases ForgeMBeanServerSupport Missing Authentication RCE https://www.zerodayinitiative.com/advisories/ZDI-26-854/

## From the sources

Quest Foglight for Databases ForgeMBeanServerSupport Missing Authentication Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Quest Foglight for Databases. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the ForgeMBeanServerSupport module. The issue results from the lack of authentication prior to allowing access to functionality. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. Was ZDI-CAN-29168.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_