Foglight for Databases CVE-2026-92188

Exploitation requires network access to the ForgeMBeanServerSupport module (an exposed MBean server endpoint) of Quest Foglight for Databases. Per the ZDI advisory and the CVSS vector (AV:N/AC:L/PR:N/UI:N), no special conditions apply - remote unauthenticated exploitation is possible because the module lacks an authentication check before granting access to its functionality, and successful exploitation runs code as SYSTEM. The practical limiting factor is network reachability of the Foglight management/MBean service: deployments where this service is not exposed to the attacker's network segment, or is firewalled/segmented away from untrusted networks, materially reduce exposure. No user interaction, credentials, or non-default configuration is required according to the available evidence.

All available severity signals point in the same direction for this issue. The CVSS 3.0 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base 9.8) describes remote, low-complexity, unauthenticated exploitation with full confidentiality, integrity, and availability impact, and the description confirms code execution in the context of SYSTEM - the maximal technical impact. The vuln.today priority is act_now, and the flaw originates from a Trend Micro ZDI advisory (ZDI-26-854, formerly ZDI-CAN-29168), a credible research source. This is a genuine high-priority issue rather than a high-CVSS-but-low-real-risk one: a missing-authentication flaw (CWE-306) that yields SYSTEM-level RCE is directly and reliably exploitable once the service is reachable. That said, several decision signals are missing from the input and should temper absolute urgency scoring: there is NO EPSS exploitation-probability score provided, NO CISA KEV listing provided (so active exploitation is not confirmed), NO SSVC automatable/exposure breakdown, and NO public exploit code referenced - the only reference is the ZDI advisory itself, which is a disclosure notice, not working exploit code. In short, the intrinsic severity and ease of exploitation are near-worst-case, but evidence of real-world exploitation volume (EPSS/KEV) is absent and cannot be assumed; prioritize patching on the strength of the unauthenticated-RCE mechanism and the act_now label rather than on confirmed in-the-wild activity.

An attacker with network reachability to a Quest Foglight for Databases installation sends requests directly to the ForgeMBeanServerSupport module, which exposes functionality without first checking authentication. Because no credentials or user interaction are required (AV:N/AC:L/PR:N/UI:N), the attacker invokes the exposed functionality to run arbitrary code as SYSTEM on the host. No public exploit identified at time of analysis; the only referenced material is the ZDI advisory.