Quest Foglight for Databases Suffers Critical Unauthenticated RCE Vulnerability
Zero Day Initiative has disclosed ZDI-26-854, a critical remote code execution vulnerability in Quest Foglight for Databases, allowing unauthenticated attackers to execute arbitrary code with SYSTEM privileges.
A critical remote code execution (RCE) vulnerability has been identified in Quest Foglight for Databases, according to an advisory from the Zero Day Initiative (ZDI). The flaw, tracked as ZDI-26-854 and assigned CVE-2026-92188, resides within the ForgeMBeanServerSupport component of the software.
Exploitation of this vulnerability does not require any form of authentication, making it a prime target for attackers seeking to gain unauthorized access. The specific weakness lies in the ForgeMBeanServerSupport module, where functionality is exposed without proper authorization checks. This oversight allows a remote attacker to send specially crafted requests that trigger code execution.
Successful exploitation of this vulnerability grants attackers the ability to execute arbitrary code on the affected systems. Crucially, this code runs with SYSTEM privileges, the highest level of authority on a Windows system, providing attackers with complete control over the compromised environment. The vulnerability carries a severe CVSS score of 9.8, underscoring its critical nature.
Quest has addressed this vulnerability by releasing Foglight version 8.3. Users of Quest Foglight for Databases are strongly advised to update to this patched version as soon as possible to mitigate the risk of exploitation. The ZDI advisory details the timeline of the disclosure, with the vulnerability initially reported to Quest on April 30, 2026, and the coordinated public release occurring on November 3, 2026.
The implications of this vulnerability are significant for organizations relying on Quest Foglight for Databases for monitoring and managing their database environments. Unauthenticated RCE can lead to a complete system compromise, potentially resulting in data breaches, ransomware attacks, or the use of the compromised system as a pivot point for further network intrusion.
This disclosure highlights the ongoing challenges in securing complex enterprise software. Database monitoring tools, while essential for operational health, often present attractive targets due to the sensitive data they manage and the high privileges they typically operate with. The lack of authentication in this specific component is a particularly concerning oversight.
Security teams should prioritize patching this vulnerability and review their network for any signs of compromise. Given the high CVSS score and the ease of exploitation (no authentication required), it is likely that this vulnerability will be actively targeted by threat actors in the wild. Proactive defense and rapid patching are key to preventing successful attacks.
Organizations should also ensure their security practices include regular vulnerability scanning and prompt application of vendor-supplied patches. Staying informed about disclosures from reputable sources like the Zero Day Initiative is crucial for maintaining a robust security posture against emerging threats.
This new advisory, ZDI-26-863, details a separate local privilege escalation vulnerability within Quest Foglight for Databases, distinct from the previously reported unauthenticated RCE. The current flaw stems from a hardcoded encryption key in the EncryptionUtil component, allowing attackers with initial low-privilege code execution to gain elevated SYSTEM privileges. This vulnerability has been fixed in Foglight version 8.3.
This new advisory, ZDI-26-857, details a separate directory traversal vulnerability in Quest Foglight for Databases, distinct from the unauthenticated RCE in ZDI-26-854. While ZDI-26-857 also allows for remote code execution, it requires prior authentication and affects the loadManageServerLicense script, leading to SYSTEM-level code execution with a CVSS score of 8.8.
This new advisory, ZDI-26-865, details a separate local privilege escalation vulnerability within Quest Foglight for Databases. Unlike the previously reported unauthenticated remote code execution flaw (ZDI-26-854), this new vulnerability requires an attacker to first gain low-privileged code execution on the target system. The flaw stems from incorrect folder permissions during the product's installation process, allowing escalation to SYSTEM privileges.
This new advisory, ZDI-26-851, details a distinct deserialization vulnerability within Quest Foglight for Databases' baseRmiServiceExporter component. Unlike the previously reported ZDI-26-854 which involved an unauthenticated RCE via SYSTEM privileges, this specific flaw allows for arbitrary code execution due to improper validation of user-supplied data prior to deserialization, also without requiring authentication.