---
id: "CVE-2026-92190"
kind: "vulnerability"
aliases: ["CVE-2026-92190"]
title: "Quest Foglight for Databases: unauthenticated remote code execution as SYSTEM via deserialization"
severity: "critical"
cvss: 9.8
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "Foglight for Databases", "fixed": ["8.3"], "affected": "< 8.3", "ecosystem": "vendor"}]
ecosystems: []
tags: ["deserialization", "other", "quest-foglight", "rce", "self-hosted", "windows"]
not_affected_if: ["not-installed"]
published_at: "2026-11-04T00:17:29+00:00"
first_seen_at: "2026-11-04T00:46:18+00:00"
updated_at: "2026-11-04T00:48:17+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-92190", "first_seen_at": "2026-11-04T00:46:18+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-11-04T00:48:17+00:00"}]
---

# Quest Foglight for Databases: unauthenticated remote code execution as SYSTEM via deserialization

Quest Foglight for Databases has an unsafe deserialization flaw in its baseRmiServiceExporter bean that accepts untrusted data. A remote attacker with no login can run arbitrary code on the server as SYSTEM.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Foglight for Databases affected < 8.3 fixed 8.3

## How to check

Check the installed Foglight for Databases version in the Foglight management server UI or installer. Anything below 8.3 should be treated as exposed. Also check whether the Foglight server's RMI service port is reachable from untrusted networks.

## Fix

Upgrade Foglight for Databases to 8.3 (per ZDI-26-851; Quest's own advisory not located)

## Timeline

- 2026-11-04T00:46:18+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-92190
- 2026-11-04T00:48:17+00:00 analyst — ZDI-26-851 (9.8, reported 2026-04-30, public 2026-11-03) says fixed in Foglight 8.3. I found no Quest vendor advisory, so no fields are marked verified. The affected range below 8.3 is unconfirmed. No exploitation or PoC is reported. Sibling ZDI advisories for the same product (e.g. ZDI-26-854, 859, 860) are also fixed in 8.3.

## Documents

- [advisory] ZDI-26-851 Quest Foglight for Databases baseRmiServiceExporter deserialization RCE https://www.zerodayinitiative.com/advisories/ZDI-26-851/

## From the sources

Quest Foglight for Databases baseRmiServiceExporter Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Quest Foglight for Databases. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the configuration of the baseRmiServiceExporter bean. The issue results from the lack of proper validation of user-supplied data prior to deserializing it. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. Was ZDI-CAN-29170.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_