---
title: Quest Foglight for Databases: 16 ZDI advisories including three unauthenticated SYSTEM-level RCEs (CVSS 9.8); upgrade to Foglight 8.3 | ctxsec
url: https://ctxsec.com/items/quest-foglight-databases-16-zdi-advisories-three-unauth-rce-fixed-8-3
description: "On Nov 3 the Zero Day Initiative published 16 advisories (ZDI-26-851 to 866) for Quest Foglight for Databases, all marked fixed in Foglight 8.3. Three are unauthenticated remote code execution as SYSTEM, rated CVSS 9.8: unsafe deserialization in the baseRmiServiceExporter bean (CVE-2026-92190), a missing-authentication flaw in ForgeMBeanServerSupport (CVE-2026-92188), and a file-path flaw in writeTopologySectionToFile (CVE-2026-92189). There are also two unauthenticated XXE information leaks (CVE-2026-92198, 92185), seven authenticated RCEs rated 8.8 (directory traversal, incorrect authorization in runScript), a template-injection RCE, a file read, and two local privilege escalations, including a hardcoded encryption key. ZDI doesn't report any exploitation."
status: "official (Zero Day Initiative ZDI-26-851 to ZDI-26-866, Nov 3; fixed in Foglight 8.3)"
published: 2026-11-04
---

> On Nov 3 the Zero Day Initiative published 16 advisories (ZDI-26-851 to 866) for Quest Foglight for Databases, all marked fixed in Foglight 8.3. Three are unauthenticated remote code execution as SYSTEM, rated CVSS 9.8: unsafe deserialization in the baseRmiServiceExporter bean (CVE-2026-92190), a missing-authentication flaw in ForgeMBeanServerSupport (CVE-2026-92188), and a file-path flaw in writeTopologySectionToFile (CVE-2026-92189). There are also two unauthenticated XXE information leaks (CVE-2026-92198, 92185), seven authenticated RCEs rated 8.8 (directory traversal, incorrect authorization in runScript), a template-injection RCE, a file read, and two local privilege escalations, including a hardcoded encryption key. ZDI doesn't report any exploitation.

[← Cybersecurity News](/news) · [markdown](/items/quest-foglight-databases-16-zdi-advisories-three-unauth-rce-fixed-8-3.md)

official (Zero Day Initiative ZDI-26-851 to ZDI-26-866, Nov 3; fixed in Foglight 8.3)

2026-11-04

### Quest Foglight for Databases: 16 ZDI advisories including three unauthenticated SYSTEM-level RCEs (CVSS 9.8); upgrade to Foglight 8.3

- **Fix:** upgrade Foglight for Databases to 8.3 (per ZDI's advisories). Several reports date back to April and May 2026, so vendor fixes have been out for some time.
- **Unauthenticated, 9.8:** CVE-2026-92190 (ZDI-26-851), CVE-2026-92188 (ZDI-26-854), CVE-2026-92189 (ZDI-26-861).
- **Until patched:** keep Foglight's management, web and RMI/JMX ports reachable only from admin networks. It's a monitoring server that holds database credentials, so treat an exposed, unpatched instance as a credential risk.
- **Other CVEs:** 92185, 92186, 92187, 92191, 92192, 92193, 92194, 92195, 92196, 92197, 92198, 92199, 92200.

Sources: [ZDI-26-851: Foglight baseRmiServiceExporter deserialization RCE (CVE-2026-92190)](https://www.zerodayinitiative.com/advisories/ZDI-26-851/) · [ZDI-26-854: Foglight ForgeMBeanServerSupport missing authentication RCE (CVE-2026-92188)](https://www.zerodayinitiative.com/advisories/ZDI-26-854/) · [ZDI-26-861: Foglight writeTopologySectionToFile RCE (CVE-2026-92189)](https://www.zerodayinitiative.com/advisories/ZDI-26-861/) · [ZDI published advisories list](https://www.zerodayinitiative.com/advisories/published/)