Quest Foglight CVE-2026-92190
CRITICALAttack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach exposed RMI service endpoint
-
DeliverySend crafted serialized Java object
-
ExploitTrigger unvalidated deserialization in baseRmiServiceExporter
-
ExecutionExecute gadget chain as SYSTEM
-
ImpactFull host compromise
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A08:2025 - Software or Data Integrity Failures
ASVS 5.0
V1 - Encoding and Sanitization Safe deserialization, type allowlists
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network reachability to the Quest Foglight for Databases RMI service exposed through the baseRmiServiceExporter bean, which deserializes user-supplied data without validation. Per the CVSS vector (PR:N/UI:N) exploitation is unauthenticated and needs no user interaction, so any attacker able to reach that RMI listener on a default installation can attempt it. The primary limiting factor is network exposure of the RMI port: deployments where the Foglight management server and its RMI service are segmented from untrusted networks substantially reduce reachability, but no non-default feature toggle is described as required to trigger the flaw. |
| Impact | This is a genuine high-priority issue, not a high-CVSS-but-low-real-risk case. The CVSS 3.0 vector (AV:N/AC:L/PR:N/UI:N) describes an unauthenticated, network-reachable, low-complexity flaw with full C:H/I:H/A:H impact, and the CWE-502 deserialization-of-untrusted-data mechanism in the baseRmiServiceExporter bean is exactly the class that yields reliable remote code execution. The vuln.today decision label is 'act_now', which aligns with the 9.8 severity and the attacker outcome of code execution as SYSTEM. Countervailing or missing signals should be stated plainly: there is no EPSS score, no SSVC decision content, and no CISA KEV listing in the provided data, so active exploitation is NOT confirmed; the only reference is the Zero Day Initiative advisory ZDI-26-851 (a vendor-coordinated disclosure, not working exploit code). No POC is marked present. In short, the technical risk is severe and the remediation urgency is high per the act_now label, but the real-world exploitation evidence is currently limited to the disclosure itself rather than observed in-the-wild activity. |
| Exploit ScenarioDerived | A remote, unauthenticated attacker sends a crafted serialized Java object to the exposed RMI service backed by the baseRmiServiceExporter bean. Because user-supplied data is deserialized without validation, the payload triggers a gadget chain that executes arbitrary code in the context of SYSTEM. No public exploit code is identified in the provided data, though a coordinated ZDI advisory (ZDI-26-851) documents the flaw. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Nov 04, 2026
Unauthenticated remote code execution in Quest Foglight for Databases lets any network attacker who can reach the RMI service execute arbitrary code in the context of SYSTEM. The flaw sits in the configuration of the baseRmiServiceExporter bean, which deserializes attacker-supplied data without validation (CWE-502); the assessed vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (9.8), meaning no credentials and no user interaction are needed. This is a genuine high-priority issue: the only meaningful limiter is whether the RMI listener is reachable from untrusted networks, so Foglight deployments exposed beyond a trusted segment should be treated as urgent (priority label act_now); no public exploit code has been identified at time of analysis and the vulnerability is not listed as actively exploited in the supplied data.
RemediationAI
No vendor-released patch version is identified in the available data, so the primary action is to obtain the fixed build from Quest and confirm scope against the ZDI advisory ZDI-26-851 (https://www.zerodayinitiative.com/advisories/ZDI-26-851/); the advisory is the authoritative source for patch availability and version guidance. Until a patched build is applied, the most effective compensating control is to restrict network access to the RMI service exposed through the baseRmiServiceExporter bean - firewall or segment the Foglight management server so the RMI listener is reachable only from trusted hosts, and block the RMI port(s) at the perimeter - with the trade-off that Foglight components and clients that rely on RMI communication will fail until the permitted source ranges are re-allowed. Because exploitation is unauthenticated and requires no user interaction, exposure should be treated as urgent (priority label act_now) for any deployment whose RMI listener is reachable from untrusted networks.
Affected ProductsAI
Quest Foglight for Databases installations in which the baseRmiServiceExporter bean is configured and its RMI service is network-reachable. The supplied intelligence provides no CPE identifiers and no explicit version range, so the exact affected builds cannot be enumerated from this data; the authoritative scope statement is the vendor/ZDI advisory ZDI-26-851 (https://www.zerodayinitiative.com/advisories/ZDI-26-851/), which should be consulted for the precise product and version coverage. Deployments where the Foglight management server and its RMI listener are segmented from untrusted networks have substantially reduced exposure, but no non-default feature toggle is described as required to trigger the flaw.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is Java deserialization of untrusted data (CWE-502) in the RMI remoting layer of Quest Foglight for Databases. The baseRmiServiceExporter bean is a Spring-style RMI service exporter that binds a service object to an RMI registry and accepts serialized Java objects over the network; because the bean is configured in a way that does not validate incoming user-supplied data before deserialization, a crafted serialized payload sent to the exposed RMI endpoint is reconstructed on the server and can drive arbitrary code execution under the account running the Foglight server (reported as SYSTEM). The CVSS vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H confirms the attack path is network-based, requires no privileges and no user interaction, and yields high confidentiality, integrity and availability impact within the Foglight process's security context; the assessed vector is identical in substance. The supplied data does not include CPE strings or a version range, so the precise set of affected Foglight for Databases builds is not enumerated here; the trigger path is network reachability to the RMI service exposed through the baseRmiServiceExporter bean.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Unauthenticated network-reachable RMI deserialization with no user interaction gives AV:N/AC:L/PR:N/UI:N, and code execution as SYSTEM yields full C:H/I:H/A:H.
Primary rating from Vendor (trendmicro).
CVSS VectorVendor: trendmicro
DescriptionCVE.org
Quest Foglight for Databases baseRmiServiceExporter Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Quest Foglight for Databases. Authentication is not required to exploit this vulnerability.
The specific flaw exists within the configuration of the baseRmiServiceExporter bean. The issue results from the lack of proper validation of user-supplied data prior to deserializing it. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. Was ZDI-CAN-29170.
Executive ViewAI
Quest Foglight for Databases contains a critical unauthenticated remote code execution vulnerability that allows any network attacker to execute arbitrary code with SYSTEM privileges. This affects all Foglight deployments where the RMI service is reachable from untrusted networks, potentially leading to full system compromise and data breach. Leadership should prioritize immediate remediation given the severity and potential for widespread impact.
No vendor-released patch identified at time of analysis. Interim mitigations include restricting network access to the RMI service, enabling authentication where possible, and monitoring for anomalous deserialization activity.
Threat Intelligence Overview
NVD
CVE.org
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Insecure deserialization occurs when an application converts serialized data (a stream of bytes representing an object's state) back into a living object without proper validation.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
GitHub PoC
Exploit-DB