Critical Remote Code Execution in Quest Foglight for Databases (CVE‑2026‑92188) Bypasses Authentication
What It Is — The Zero Day Initiative advisory (ZDI‑26‑854) details a remote code execution flaw in Quest Foglight for Databases. The vulnerability resides in the ForgeMBeanServerSupport module, which fails to require any authentication before exposing privileged MBean operations. An unauthenticated attacker can invoke the module to execute arbitrary code with SYSTEM‑level privileges on the host running Foglight. The CVSS vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, yielding a score of 9.8 (Critical). Quest released a fix in Foglight 8.3; earlier versions remain vulnerable. No public exploitation has been reported, but the severity and lack of authentication make it a high‑impact, easy‑to‑weaponize issue.
Affected Products — Quest Foglight for Databases (all versions prior to 8.3).
Why It Matters for Trust & Control Assurance — The flaw demonstrates a missing authentication control for privileged functions, directly testing the “enforce authentication for privileged operations” control objective.
Recommended Actions —
- Upgrade all Foglight for Databases installations to version 8.3 or later.
- Verify that MBean interfaces are protected by authentication mechanisms.
- Document the patch status in your configuration management database (CMDB) as audit evidence.
Source: Zero Day Initiative advisory