Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Buy Us a Coffee

CVE-2026-92188— Quest Foglight for Databases ForgeMBeanServerSupport Missing Authentication Remote Code Execution Vulnerability

Quick assessment

Affected

Quest Foglight for Databases

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Quest Foglight for Databases 的 ForgeMBeanServerSupport 组件存在缺少身份验证的远程代码执行漏洞。该漏洞允许远程攻击者在受影响的 Quest Foglight for Databases 安装实例上执行任意代码，且利用此漏洞无需进行身份验证。该具体缺陷存在于 ForgeMBeanServerSupport 模块中，问题根源在于在允许访问相关功能之前未实施身份验证。攻击者可利用此漏洞，以 SYSTEM 上下文执行代码。该漏洞编号为 ZDI-CAN-29168。

AI Predicted 9.8 Difficulty: Easy Updated Nov 04, 2026

Possible ATT&CK Techniques 2 AI

T1055 · Process Injection T1190 · Exploit Public-Facing Application

Updated Nov 04, 2026

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Quest Foglight for Databases ForgeMBeanServerSupport Missing Authentication Remote Code Execution Vulnerability

Source: CVE Program / CVE List V5

Vulnerability Description

Quest Foglight for Databases ForgeMBeanServerSupport Missing Authentication Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Quest Foglight for Databases. Authentication is not required to exploit this vulnerability. The specific flaw exists within the ForgeMBeanServerSupport module. The issue results from the lack of authentication prior to allowing access to functionality. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. Was ZDI-CAN-29168.

Source: CVE Program / CVE List V5

CVSS Information

N/A

Source: CVE Program / CVE List V5

Vulnerability Type

关键功能的认证机制缺失

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
Quest	Foglight for Databases	8.2.0	-

II. Public POCs for CVE-2026-92188

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-92188

请登录查看更多情报信息。

Other References for CVE-2026-92188 (1)

https://www.zerodayinitiative.com/advisories/ZDI-26-854/ x_research-advisory

https://www.cve.org/CVERecord?id=CVE-2026-92188

Same Patch Batch · Quest · 2026-11-03 · 16 CVEs total

CVE-2026-92197		Quest Foglight for Databases unzipFile Directory Traversal Remote Code Execution Vulnerabi
CVE-2026-92198		Quest Foglight for Databases getSource XML External Entity Processing Information Disclosu
CVE-2026-92189		Quest Foglight for Databases writeTopologySectionToFile External Control of File Path Remo
CVE-2026-92199		Quest Foglight for Databases EncryptionUtil Hardcoded Encyption Key Local Privilege Escala
CVE-2026-92193		Quest Foglight for Databases FileServlet External Control of File Path Information Disclos
CVE-2026-92192		Quest Foglight for Databases installLicense Directory Traversal Remote Code Execution Vuln
CVE-2026-92200		Quest Foglight for Databases Incorrect Permission Assignment Local Privilege Escalation Vu
CVE-2026-92195		Quest Foglight for Databases loadEvolveLicense Directory Traversal Remote Code Execution V
CVE-2026-92186		Quest Foglight for Databases paFnUploadFileAndCreateInfo Directory Traversal Remote Code E
CVE-2026-92190		Quest Foglight for Databases baseRmiServiceExporter Deserialization of Untrusted Data Remo
CVE-2026-92194		Quest Foglight for Databases loadManageServerLicense Directory Traversal Remote Code Execu
CVE-2026-92185		Quest Foglight for Databases AbstractParser XML External Entity Processing Information Dis
CVE-2026-92191		Quest Foglight for Databases runScript Incorrect Authorization Remote Code Execution Vulne
CVE-2026-92196		Quest Foglight for Databases renderTemplateString Server-Side Template Injection Remote Co
CVE-2026-92187		Quest Foglight for Databases extractAndCreateUploadInfoList Directory Traversal Remote Cod

IV. Related Vulnerabilities

Same product: Foglight for Databases

Same vendor: Quest

Same weakness: CWE-306