Quest Foglight for Databases Missing Authentication Remote Code Execution (CVE-2026-92188)

ZDI says the flaw lets remote attackers execute arbitrary code on affected Quest Foglight for Databases installations, and that authentication is not required. ZDI, which is also the CVE numbering authority, rates it CVSS 3.0 9.8 Critical. The advisory is ZDI-26-854, tracked before release as ZDI-CAN-29168.

What the Missing Check Means

The record says the flaw exists within the ForgeMBeanServerSupport module and "results from the lack of authentication prior to allowing access to functionality." In plain terms, a function that should ask who is calling does not ask. An attacker has no password to guess and no session to steal.

That makes network reach the whole question. If a host can connect to the vulnerable service, the record says it can run code in the context of SYSTEM, the most privileged local account on a Windows machine.

What the Record Leaves Open

Neither the CVE record nor the ZDI advisory names a port, a protocol or a setting that turns the module on. They do not describe the steps of an attack or say what the attacker sends. The advisory also does not state the operating system, so the Windows meaning of SYSTEM is our reading.

Until Quest or ZDI says more, we treat every Foglight 8.2.0 server as reachable and ask who can connect to it. The answer, not a guess about the module, drives the order of work.

Signals for CVE-2026-92188

These are the public signals we checked on 4 November 2026. Each row names its source.

Both Blackhole posts repeat the advisory text and add no new detail. Two sibling flaws in the same product were disclosed the same day: the file path flaw CVE-2026-92189 and the deserialization flaw CVE-2026-92190. Each has its own ZDI advisory, and our remote code execution glossary entry covers the wider class.

The CVE record lists one product and one version. It sets the default status of all other versions to unknown, so it neither clears nor condemns them.

ZDI writes "Fixed in Foglight 8.3" under Additional Details of advisory ZDI-26-854. The fix line is the same on the advisories for CVE-2026-92189 and CVE-2026-92190. We have not seen a separate hotfix named in the record.

Because only 8.2.0 is listed, we treat earlier 8.x builds as unverified, not as safe. Our vulnerability management guide describes how to inventory versions and plan a rollout.