CVE-2026-92196: Quest Foglight for Databases SSTI Remote Code Execution — Detection and Remediation Guide

---
title: Foglight Management Server Spawning Shell or Script Interpreter
id: 8f3a2b41-7c1d-4e9a-b5f2-6d8e1a4c9b07
status: experimental
description: Detects the Foglight for Databases Java process spawning command shells, script interpreters, or download utilities — a strong indicator of successful server-side template injection exploitation (CVE-2026-92196, ZDI-26-866).
references:
  - http://www.zerodayinitiative.com/advisories/ZDI-26-866/
  - https://attack.mitre.org/techniques/T1190/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.initial_access
  - attack.t1190
  - attack.execution
  - attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\foglight.exe'
      - '\fms.exe'
      - '\java.exe'
      - '\javaw.exe'
    ParentCommandLine|contains:
      - 'foglight'
      - 'quest'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
      - '\certutil.exe'
      - '\bitsadmin.exe'
      - '\curl.exe'
      - '\wget.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Foglight custom scripts or agent deployment actions legitimately invoking cmd or PowerShell — baseline your environment before alerting at high severity
level: high
---
title: Webshell or Suspicious File Dropped in Foglight Web Root
id: 2c7d9e15-4a8b-4f36-91d0-3b5e7a2c8f46
status: experimental
description: Detects creation of script files (JSP, ASPX, WAR contents) in Foglight web/application directories, consistent with post-exploitation webshell deployment following template injection code execution.
references:
  - http://www.zerodayinitiative.com/advisories/ZDI-26-866/
  - https://attack.mitre.org/techniques/T1505.003/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.persistence
  - attack.t1505.003
logsource:
  category: file_event
  product: windows
detection:
  selection_path:
    TargetFilename|contains:
      - '\Quest\Foglight\'
      - '\foglight\server\'
      - '\foglight\jboss\'
      - '\foglight\tomcat\'
  selection_ext:
    TargetFilename|endswith:
      - '.jsp'
      - '.jspx'
      - '.war'
      - '.aspx'
      - '.php'
      - '.class'
  condition: selection_path and selection_ext
falsepositives:
  - Legitimate Foglight cartridge deployment and upgrades — correlate with patch windows and change tickets
level: medium
---
title: Foglight Server Process Making Unusual Outbound Network Connections
id: 5b1e8c73-9d2f-4a68-b7e4-1c3f6d9a2e85
status: experimental
description: Detects the Foglight Management Server process initiating outbound connections to uncommon external destinations, which may indicate payload retrieval or C2 following CVE-2026-92196 exploitation.
references:
  - http://www.zerodayinitiative.com/advisories/ZDI-26-866/
  - https://attack.mitre.org/techniques/T1071/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.command_and_control
  - attack.t1071
  - attack.t1105
logsource:
  category: network_connection
  product: windows
detection:
  selection_image:
    Image|endswith:
      - '\foglight.exe'
      - '\fms.exe'
      - '\java.exe'
      - '\javaw.exe'
  selection_cmdline:
    CommandLine|contains: 'foglight'
  filter_internal:
    DestinationIp|startswith:
      - '10.'
      - '172.16.'
      - '192.168.'
      - '127.'
  condition: selection_image and selection_cmdline and not filter_internal
falsepositives:
  - Quest update/licensing servers and cloud-monitored database endpoints — whitelist known Quest infrastructure after baseline
level: medium

// Hunt: Foglight process spawning shells or LOLBins (CVE-2026-92196 / ZDI-26-866)
let foglightParents = dynamic(["foglight.exe", "fms.exe", "java.exe", "javaw.exe", "java"]);
let suspiciousChildren = dynamic(["cmd.exe", "powershell.exe", "pwsh.exe", "mshta.exe", "wscript.exe", "cscript.exe", "rundll32.exe", "certutil.exe", "bitsadmin.exe", "curl.exe", "wget.exe", "sh", "bash", "python", "python3", "perl", "nc", "ncat"]);
union isfuzzy=true
    (DeviceProcessEvents
    | where TimeGenerated > ago(14d)
    | where InitiatingProcessFileName has_any (foglightParents)
        or InitiatingProcessCommandLine has_any ("foglight", "quest")
    | where FileName has_any (suspiciousChildren)
    | project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, AccountName, ReportId),
    (Syslog
    | where TimeGenerated > ago(14d)
    | where Facility == "user" or Facility == "auth" or Facility == "audit"
    | where SyslogMessage has_any ("foglight", "java")
        and SyslogMessage has_any ("/bin/sh", "/bin/bash", "curl", "wget", "python")
    | project TimeGenerated, HostName, ProcessName, SyslogMessage, SeverityLevel)
| order by TimeGenerated desc

-- Foglight Management Server compromise triage (ZDI-26-866 / CVE-2026-92196)
-- Enumerate Foglight/Java processes, children, and recent script-file drops in Foglight dirs
SELECT Pid, Ppid, Name, CommandLine, Exe, Username, CreateTime,
       getprocess(pid=Ppid).Name AS ParentName,
       getprocess(pid=Ppid).CommandLine AS ParentCommandLine
FROM pslist()
WHERE Name =~ '(?i)foglight|fms|java'
   OR ParentName =~ '(?i)foglight|fms|java'
   OR (ParentName =~ '(?i)java' AND Name =~ '(?i)cmd|powershell|sh|bash|curl|wget|python')

-- Recent executable/script artifacts written under Foglight installation paths (last 14 days)
SELECT FullPath, Size, Mtime, Ctime
FROM glob(globs=['C:/Quest/Foglight/**/*.jsp', 'C:/Quest/Foglight/**/*.war',
                 'C:/Quest/Foglight/**/*.class', 'C:/Quest/Foglight/**/*.exe',
                 'C:/Quest/Foglight/**/*.ps1', 'C:/Quest/Foglight/**/*.bat',
                 '/opt/quest/foglight/**/*.jsp', '/opt/quest/foglight/**/*.sh',
                 '/home/foglight/**/*.jsp', '/home/foglight/**/*.sh'])
WHERE Mtime > now() - 1209600
ORDER BY Mtime DESC

# Foglight CVE-2026-92196 triage and verification script
# Run elevated on the Foglight Management Server

# 1. Identify installed Foglight version
Write-Host "=== Installed Quest Foglight Components ===" -ForegroundColor Cyan
Get-ItemProperty HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*,
                 HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\* |
  Where-Object { $_.DisplayName -match 'Foglight|Quest' } |
  Select-Object DisplayName, DisplayVersion, InstallDate | Format-Table -AutoSize

# 2. Enumerate Foglight/Java processes and any suspicious child processes
Write-Host "=== Foglight Processes and Children ===" -ForegroundColor Cyan
$fogProcs = Get-CimInstance Win32_Process | Where-Object {
  $_.Name -match 'foglight|fms|java' -and $_.CommandLine -match 'foglight|quest'
}
foreach ($p in $fogProcs) {
  Write-Host "[$($p.ProcessId)] $($p.Name) :: $($p.CommandLine)"
  Get-CimInstance Win32_Process | Where-Object { $_.ParentProcessId -eq $p.ProcessId } |
    ForEach-Object {
      $flag = if ($_.Name -match 'cmd|powershell|pwsh|mshta|wscript|cscript|rundll32|certutil|bitsadmin|curl|wget') { ' *** SUSPICIOUS ***' } else { '' }
      Write-Host "    -> [$($_.ProcessId)] $($_.Name)$flag"
    }
}

# 3. Scan Foglight directories for recently modified script/executable artifacts
Write-Host "=== Recently Modified Artifacts in Foglight Paths (14 days) ===" -ForegroundColor Cyan
$fogRoot = 'C:\Quest\Foglight'
if (Test-Path $fogRoot) {
  Get-ChildItem -Path $fogRoot -Recurse -Include *.jsp,*.jspx,*.war,*.class,*.exe,*.ps1,*.bat,*.dll -ErrorAction SilentlyContinue |
    Where-Object { $_.LastWriteTime -gt (Get-Date).AddDays(-14) } |
    Select-Object LastWriteTime, FullName | Sort-Object LastWriteTime -Descending | Format-Table -AutoSize
}

# 4. Check for unexpected local admins created recently
Write-Host "=== Local Administrators (review for anomalies) ===" -ForegroundColor Cyan
Get-LocalGroupMember -Group 'Administrators' -ErrorAction SilentlyContinue | Format-Table -AutoSize

#!/bin/bash
# Foglight CVE-2026-92196 triage for Linux-hosted Management Servers
# Run as root or with sudo

echo "=== Foglight Processes ==="
ps auxww | grep -iE 'foglight|java' | grep -v grep

echo ""
echo "=== Suspicious Child Processes of Foglight/Java ==="
for pid in $(pgrep -f 'foglight|java'); do
  children=$(ps --ppid "$pid" -o pid,comm,args --no-headers 2>/dev/null)
  if echo "$children" | grep -qE 'sh|bash|curl|wget|python|perl|nc '; then
    echo "[!] PID $pid has suspicious children:"
    echo "$children"
  fi
done

echo ""
echo "=== Recently Modified Artifacts Under Foglight Paths (14 days) ==="
for dir in /opt/quest/foglight /home/foglight /usr/local/foglight; do
  [ -d "$dir" ] && find "$dir" -type f \( -name '*.jsp' -o -name '*.war' -o -name '*.sh' -o -name '*.class' \) -mtime -14 -ls
done

echo ""
echo "=== Recent Authentications to Foglight Host ==="
last -20 2>/dev/null; journalctl _COMM=sshd --since "14 days ago" 2>/dev/null | grep -i 'accepted' | tail -20