Glossary term
Patch management
Patch management is the process of identifying, prioritizing, acquiring, installing, and verifying patches, updates, and upgrades across an organization.
Read more
Vulnerability
Quest Foglight for Databases Deserialization of Untrusted Data Remote Code Execution (CVE-2026-92190)
A critical deserialization of untrusted data flaw in the baseRmiServiceExporter bean of Quest Foglight for Databases.
- CVE ID
- CVE-2026-92190
- CVSS
- 9.8 Critical (CVSS v3.0, ZDI as CNA; no CVSS 3.1 or 4.0 score in the record or NVD)
- Affected product
- Quest Foglight for Databases 8.2.0
- Exploited
- Unknown
- Published
- 3 November 2026 (ZDI-26-851 and CVE record); NVD entry 4 November 2026
In short
CVE-2026-92190 is a critical deserialization of untrusted data flaw in the baseRmiServiceExporter bean of Quest Foglight for Databases. ZDI says the software deserializes user-supplied data without proper validation, so a remote attacker with no login can run code as SYSTEM. The record lists version 8.2.0 as affected, and ZDI says Foglight 8.3 is the fix.
- CVECVE-2026-92190
- ProductQuest Quest Foglight for Databases 8.2.0
- Fix Steps4actions listedUpgrade to Foglight 8.3 · Watch for Odd Child Processes
What it allows
ZDI advisory ZDI-26-851 says the flaw exists "within the configuration of the baseRmiServiceExporter bean." It "results from the lack of proper validation of user-supplied data prior to deserializing it." ZDI rates it CVSS 3.0 9.8 Critical, with no authentication needed.
Reading the Name of the Bean
The record points at configuration, not at one line of code. In Java, a bean is an object that a framework creates and wires from configuration. RMI is Remote Method Invocation, the Java way to call methods on an object across a network.
The record does not say which port or setting makes the exporter reachable. It also does not describe the data an attacker sends. Those details are open, so we do not assume them.
Why Deserialization Ends in Code Execution
This explanation of the class is ours, not the advisory's. Serialization turns an object into bytes, and deserialization rebuilds the object from bytes. If the bytes come from an attacker, rebuilding them can trigger code that already exists in the program, and the attacker picks which code.
ZDI says the fix is in the Foglight 8.3 release. The record does not say what Quest changed in the exporter configuration, so we do not describe the repair.
Signals for CVE-2026-92190
Here is what the public record and our own data showed on 4 November 2026, one row per source.
Exploit signals
- CISA KEVNot seenNot listed in catalog version 2026.11.034 Nov
- Brandefense BlackholeYesTwo entries in our Blackhole data, dated 3 and 4 November, mention this CVE id: a repeat of ZDI-26-851 and a critical CVE summary list4 Nov
Verdict Not in CISA KEV as of catalog version 2026.11.03
ZDI published two further Foglight advisories the same day: the authentication gap CVE-2026-92188 and the file path flaw CVE-2026-92189. Our CVSS glossary entry explains the 9.8 score they share.
Who is affected
The record names one product and one version. Every other version carries the status unknown, so the list may be incomplete.
On ZDI-26-851 the line reads "Fixed in Foglight 8.3." We name no hotfix because the primary sources we read do not. A move to 8.3 is also the fix ZDI lists for CVE-2026-92188 and CVE-2026-92189.
Until the upgrade, we recommend keeping the server off networks that do not need it. Our network segmentation entry explains how to draw that line.
Timeline
- 30 Apr 2026
ZDI reports the vulnerability to the vendor, according to its disclosure timeline.
- 15 Sep 2026
The CVE identifier is reserved.
- 3 Nov 2026
ZDI publishes advisory ZDI-26-851, and the CVE record is published.
- 4 Nov 2026
NVD shows the entry with ZDI's CVSS 3.0 score and no NVD analysis yet.
What to do
-
Upgrade to Foglight 8.3
ZDI lists Foglight 8.3 as the fixed release. Start with servers on 8.2.0 and record the version of each Foglight server you run.
-
Find Which Hosts Can Reach the Server
We recommend checking which hosts can open network connections to the Foglight server, since the record does not name the port. Remove access that has no business reason.
-
Put the Server Behind Segmentation
Until the upgrade is done, we recommend allowing connections only from the hosts that administer Foglight.
-
Watch for Odd Child Processes
Code runs as SYSTEM per ZDI. We recommend alerting on unexpected processes started by the Foglight service and on new outbound connections from its host.
Questions
What is deserialization of untrusted data?
It is rebuilding an object from bytes that an outsider controls, without checking them first. ZDI says that is the flaw in the baseRmiServiceExporter bean (CWE-502).
What is a baseRmiServiceExporter bean?
The record calls it a bean, a configured Java object, and the name points to Java RMI. It does not describe what the bean exposes, so we do not.
Does Foglight 8.3 fix all three Foglight CVEs?
ZDI writes Fixed in Foglight 8.3 on each of the three advisories: ZDI-26-851, ZDI-26-854 and ZDI-26-861.
Is CVE-2026-92190 listed as exploited?
It is not in the CISA KEV catalog as of catalog version 2026.11.03.
In our research
- Patch management Glossary term
Sources
- CVE-2026-92190 Record CVE Program / ZDI CNA
- CVE-2026-92190 NVD
- ZDI-26-851 advisory Zero Day Initiative
- Known Exploited Vulnerabilities Catalog CISA
Browse the threat library
- APT groups State-backed hacking groups, who they go after and how they get in. 53 profiles
- Countries The sectors, groups and national bodies that matter in each country. 32 profiles
- Ransomware groups How each group gets in, how it extorts and what stops it. 28 profiles
- Malware and tools Malware families and abused tools, what they do and how to spot them. 60 profiles
- Techniques Attack techniques in plain words, mapped to MITRE ATT&CK. 42 profiles
- Vulnerabilities Flaws attackers use in real attacks and what to do about them. 151 profiles
- Significant Cyber Incidents Significant incidents since October 2024, with a dated timeline, sources and lessons. 109 profiles
Stay Ahead of
Digital Threats
Take control of your digital security with an exclusive demo of our AI-driven threat intelligence platform.