{"id":"CVE-2026-92190","kind":"vulnerability","aliases":["CVE-2026-92190"],"related":[],"title":"Quest Foglight for Databases: unauthenticated remote code execution as SYSTEM via deserialization","description":"Quest Foglight for Databases baseRmiServiceExporter Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Quest Foglight for Databases. Authentication is not required to exploit this vulnerability.\n\nThe specific flaw exists within the configuration of the baseRmiServiceExporter bean. The issue results from the lack of proper validation of user-supplied data prior to deserializing it. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. Was ZDI-CAN-29170.","summary":"Quest Foglight for Databases has an unsafe deserialization flaw in its baseRmiServiceExporter bean that accepts untrusted data. A remote attacker with no login can run arbitrary code on the server as SYSTEM.","severity":"critical","cvss":9.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Foglight for Databases","fixed":["8.3"],"affected":"< 8.3","ecosystem":"vendor"}],"ecosystems":[],"tags":["deserialization","other","quest-foglight","rce","self-hosted","windows"],"not_affected_if":["not-installed"],"how_to_check":"Check the installed Foglight for Databases version in the Foglight management server UI or installer. Anything below 8.3 should be treated as exposed. Also check whether the Foglight server's RMI service port is reachable from untrusted networks.","fix":"Upgrade Foglight for Databases to 8.3 (per ZDI-26-851; Quest's own advisory not located)","status":"open","published_at":"2026-11-04T00:17:29+00:00","first_seen_at":"2026-11-04T00:46:18+00:00","triaged_at":"2026-11-04T00:47:33+00:00","updated_at":"2026-11-04T00:48:17+00:00","category":"other","confidence":0.7,"triage":{"at":"2026-11-04T00:47:33Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Quest Foglight for Databases: unauthenticated remote code execution as SYSTEM via deserialization","impact":"high","summary":"Quest Foglight for Databases has an unsafe deserialization flaw in its baseRmiServiceExporter bean that accepts untrusted data. A remote attacker with no login can run arbitrary code on the server as SYSTEM.","audience":"businesses","category":"other","nicknames":[],"who_cares":["quest-foglight","windows","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Attacker runs arbitrary code as SYSTEM on the Foglight server.","analyst_note":"Find affected version ranges, fixed version and the vendor advisory for CVE-2026-92190 (ZDI-CAN-29170); the NVD entry alone gives no versions.","how_to_check":"- unknown","plain_action":"","needs_analyst":true,"not_affected_if":["not-installed"],"who_is_affected":"Organizations running Quest Foglight for Databases are exposed through the baseRmiServiceExporter configuration, which the description says is where the unvalidated data is deserialized. The sources do not list affected versions or describe a default-versus-custom configuration split, so teams should check their installed version against the vendor advisory. Teams not running Foglight for Databases are not affected.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000687,"input_tokens":4242,"output_tokens":525,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Find affected version ranges, fixed version and the vendor advisory for CVE-2026-92190 (ZDI-CAN-29170); the NVD entry alone gives no versions.","search":"'-2026':14A,17A '-92190':15A,18A '29170':149C 'accept':46B 'affect':87C 'allow':79C 'arbitrari':57B,84C 'attack':51B,81C,132C 'authent':94C 'basermiserviceexport':43B,68C,111C 'bean':44B,112C 'code':7A,58B,74C,85C,139C 'configur':108C 'context':142C 'cve':13A,16A 'data':48B,72C,126C 'databas':4A,35B,67C,93C 'databases':21A 'deseri':12A,22B,39B,69C,129C 'execut':8A,75C,83C,138C 'exist':105C 'exploit':99C 'flaw':40B,104C 'foglight':2A,19A,26B,33B,65C,91C 'for':20A 'host':30B 'instal':88C 'issu':114C 'lack':118C 'leverag':134C 'login':54B 'prior':127C 'proper':120C 'quest':1A,25B,32B,64C,90C 'quest-foglight':24B 'rce':27B 'remot':6A,50B,73C,80C 'requir':97C 'result':115C 'run':56B 'self':29B 'self-host':28B 'server':61B 'specif':103C 'suppli':125C 'system':10A,63B,144C 'unauthent':5A 'unsaf':38B 'untrust':47B,71C 'user':124C 'user-suppli':123C 'valid':121C 'via':11A 'vulner':76C,78C,101C,136C 'window':31B 'within':106C 'zdi':147C 'zdi-can':146C","nicknames":[],"mitigations":[],"who_affected":"Self-hosted Foglight for Databases management servers (Windows, code runs as SYSTEM) on versions before 8.3. An attacker who can reach the server's RMI endpoint needs no login. Teams not running Foglight for Databases can skip this. Restricting network access to the server limits exposure until you upgrade.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["foglightfordatabases","fordatabases"],"ptokens":["databases","foglight","for"],"labels":["critical","deserialization","other","questfoglight","rce","selfhosted","windows"],"campaign_type":null,"first_public_at":"2026-11-04T00:17:29+00:00","kev":null,"cvss_vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"zdi-disclosures@trendmicro.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-92190","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-92190","severity":null,"published_at":"2026-11-04T00:17:29+00:00","modified_at":"2026-11-04T00:17:29+00:00","first_seen_at":"2026-11-04T00:46:18+00:00","fetched_at":"2026-11-04T00:46:18+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-92190:1589","url":null,"severity":null,"published_at":"2026-11-04T00:48:17+00:00","modified_at":"2026-11-04T00:48:17+00:00","first_seen_at":"2026-11-04T00:48:17+00:00","fetched_at":"2026-11-04T00:48:17+00:00","note":"ZDI-26-851 (9.8, reported 2026-04-30, public 2026-11-03) says fixed in Foglight 8.3. I found no Quest vendor advisory, so no fields are marked verified. The affected range below 8.3 is unconfirmed. No exploitation or PoC is reported. Sibling ZDI advisories for the same product (e.g. ZDI-26-854, 859, 860) are also fixed in 8.3."}],"documents":[{"id":62144,"url":"https://www.zerodayinitiative.com/advisories/ZDI-26-851/","title":"ZDI-26-851 Quest Foglight for Databases baseRmiServiceExporter deserialization RCE","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}