Critical Remote Code Execution (CVE‑2026‑92190) in Quest Foglight for Databases Allows Unauthenticated Attack
What It Is — Quest Foglight for Databases contains a deserialization flaw in the baseRmiServiceExporter bean. The bean accepts attacker‑controlled data over RMI without validation and deserializes it, enabling remote code execution with SYSTEM privileges. No authentication or user interaction is required. The vulnerability is rated CVSS 9.8 (Critical) and is publicly disclosed in ZDI‑26‑851 (CVE‑2026‑92190). A fix was released in Foglight 8.3.
Affected Products — Quest Foglight for Databases (all versions prior to 8.3).
Why It Matters for Trust & Control Assurance — The issue highlights a gap in secure development and input‑validation controls; satisfying this control objective strengthens audit evidence across multiple frameworks. Capability focus: CONTROL_MAPPING – continuous evidence collection and control‑mapping to demonstrate remediation.
Recommended Actions
- Upgrade all Foglight installations to version 8.3 or later.
- Verify the running version via inventory and patch management tools.
- Conduct a targeted code‑review of any custom RMI services for unsafe deserialization patterns.
- Enable runtime application self‑protection (e.g., Java Security Manager, deserialization guards).
- Log and monitor RMI traffic for anomalous activity.
Source: Zero Day Initiative advisory