CVE-2026-92190

Summary

The vulnerability stems from unsafe deserialization of untrusted data in the baseRmiServiceExporter bean of Quest Foglight for Databases, allowing remote attackers to execute arbitrary code without authentication by crafting malicious serialized objects.

Exploitability

Exploitation is straightforward for remote attackers due to the lack of authentication and weak input validation; no user interaction or privileged access is required.

Blast radius

Successful exploitation grants SYSTEM-level code execution on the affected server, enabling full compromise of confidentiality, integrity, and availability of the host and potentially connected database environments.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to Quest Foglight for Databases version 2.590 or later, where this deserialization flaw has been patched.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.