Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Buy Us a Coffee

CVE-2026-92190— Quest Foglight for Databases baseRmiServiceExporter Deserialization of Untrusted Data Remote Code Execution Vulnerability

Quick assessment

Affected

Quest Foglight for Databases

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Quest Foglight for Databases 的 baseRmiServiceExporter 存在不可信数据反序列化导致的远程代码执行漏洞。该漏洞允许远程攻击者在受影响的 Quest Foglight for Databases 安装中执行任意代码，利用此漏洞无需进行身份验证。该具体缺陷存在于 baseRmiServiceExporter Bean 的配置中，其根源在于在反序列化用户提供的数据之前未进行适当的验证。攻击者可利用此漏洞以 SYSTEM 上下文执行代码。该漏洞编号为 ZDI-CAN-29

AI Predicted 9.8 Difficulty: Trivial Updated Nov 04, 2026

Possible ATT&CK Techniques 2 AI

T1055.001 · Dynamic-link Library Injection T1190 · Exploit Public-Facing Application

Updated Nov 04, 2026

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Quest Foglight for Databases baseRmiServiceExporter Deserialization of Untrusted Data Remote Code Execution Vulnerability

Source: CVE Program / CVE List V5

Vulnerability Description

Quest Foglight for Databases baseRmiServiceExporter Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Quest Foglight for Databases. Authentication is not required to exploit this vulnerability. The specific flaw exists within the configuration of the baseRmiServiceExporter bean. The issue results from the lack of proper validation of user-supplied data prior to deserializing it. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. Was ZDI-CAN-29170.

Source: CVE Program / CVE List V5

CVSS Information

N/A

Source: CVE Program / CVE List V5

Vulnerability Type

可信数据的反序列化

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
Quest	Foglight for Databases	8.2.0	-

II. Public POCs for CVE-2026-92190

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-92190

请登录查看更多情报信息。

Other References for CVE-2026-92190 (1)

https://www.zerodayinitiative.com/advisories/ZDI-26-851/ x_research-advisory

https://www.cve.org/CVERecord?id=CVE-2026-92190

Same Patch Batch · Quest · 2026-11-03 · 16 CVEs total

CVE-2026-92197		Quest Foglight for Databases unzipFile Directory Traversal Remote Code Execution Vulnerabi
CVE-2026-92198		Quest Foglight for Databases getSource XML External Entity Processing Information Disclosu
CVE-2026-92189		Quest Foglight for Databases writeTopologySectionToFile External Control of File Path Remo
CVE-2026-92199		Quest Foglight for Databases EncryptionUtil Hardcoded Encyption Key Local Privilege Escala
CVE-2026-92193		Quest Foglight for Databases FileServlet External Control of File Path Information Disclos
CVE-2026-92192		Quest Foglight for Databases installLicense Directory Traversal Remote Code Execution Vuln
CVE-2026-92200		Quest Foglight for Databases Incorrect Permission Assignment Local Privilege Escalation Vu
CVE-2026-92195		Quest Foglight for Databases loadEvolveLicense Directory Traversal Remote Code Execution V
CVE-2026-92186		Quest Foglight for Databases paFnUploadFileAndCreateInfo Directory Traversal Remote Code E
CVE-2026-92188		Quest Foglight for Databases ForgeMBeanServerSupport Missing Authentication Remote Code Ex
CVE-2026-92194		Quest Foglight for Databases loadManageServerLicense Directory Traversal Remote Code Execu
CVE-2026-92185		Quest Foglight for Databases AbstractParser XML External Entity Processing Information Dis
CVE-2026-92191		Quest Foglight for Databases runScript Incorrect Authorization Remote Code Execution Vulne
CVE-2026-92196		Quest Foglight for Databases renderTemplateString Server-Side Template Injection Remote Co
CVE-2026-92187		Quest Foglight for Databases extractAndCreateUploadInfoList Directory Traversal Remote Cod

IV. Related Vulnerabilities

Same product: Foglight for Databases

Same vendor: Quest

Same weakness: CWE-502