Multiple Critical Remote Code Execution and Privilege Escalation Vulnerabilities in Quest ...

Unauthenticated remote attackers can achieve full system compromise via multiple RCE vulnerabilities, necessitating an immediate upgrade to Foglight version 8.3.

On November 3, 2026, the Zero Day Initiative (ZDI) published advisories for six distinct vulnerabilities affecting Quest Foglight for Databases, all of which have been addressed in version 8.3. These vulnerabilities include multiple remote code execution (RCE) flaws, some of which do not require authentication, and local privilege escalation (LPE) issues. The vulnerabilities were reported to the vendor between April and July 2026.

The most severe vulnerabilities include CVE-2026-92189 (ZDI-26-861), an RCE flaw in the writeTopologySectionToFile method caused by improper validation of user-supplied paths, and CVE-2026-92190 (ZDI-26-851), an RCE flaw in the baseRmiServiceExporter bean due to insecure deserialization of untrusted data. Both vulnerabilities allow unauthenticated remote attackers to execute arbitrary code in the context of SYSTEM. Additionally, CVE-2026-92196 (ZDI-26-866) allows authenticated remote attackers to execute arbitrary code via the renderTemplateString method, and CVE-2026-92191 (ZDI-26-859) allows authenticated remote attackers to execute arbitrary code via the runScript function due to incorrect authorization.

Two local privilege escalation vulnerabilities were also disclosed. CVE-2026-92199 (ZDI-26-863) involves a hard-coded cryptographic key in the EncryptionUtil method, while ZDI-26-865 involves incorrect permission assignments in the product installer. Both LPE flaws require an attacker to first execute low-privileged code on the target system to escalate privileges to SYSTEM. Finally, CVE-2026-92193 (ZDI-26-853) is an information disclosure vulnerability in the FileServlet class that allows authenticated remote attackers to access sensitive information.

The presence of multiple RCE vulnerabilities, particularly those exploitable by unauthenticated attackers, presents a severe risk to any enterprise deploying Quest Foglight for Databases. Attackers gaining SYSTEM-level access can fully compromise the host server, potentially leading to lateral movement within the network, data exfiltration, or the deployment of further malicious payloads. The ability to exploit these flaws remotely without authentication significantly lowers the barrier for entry for threat actors.

Defenders must treat these vulnerabilities as a high-priority patching exercise. Because the flaws span multiple components—including RMI services, file operations, and template rendering—a comprehensive update to version 8.3 is required to ensure all attack vectors are closed. Organizations should audit their Foglight deployments to ensure they are not exposed to the internet and verify that all instances have been successfully updated to the patched version.

QPulse Advisory Block

Upgrade all instances of Quest Foglight for Databases to version 8.3 immediately.

Monitor server logs for unauthorized access attempts or unusual file operations, particularly those targeting RMI services or script execution functions.

Ensure that Foglight for Databases instances are not exposed to the public internet and restrict access to authorized internal networks only.

Implement a regular patch management cycle for all database management software and conduct periodic security assessments of third-party enterprise applications.

Advisory purposes only · QPulse Security Intelligence Platform · 2026 · Brief # 07765