Cross-Site Scripting Authentication Bypass Vulnerability in Quest NetVault Backup
CVE-2026-9780

8.8HIGH

Key Information:

Vendor

Quest

Status
Netvault Backup
Vendor
CVE Published:
24 June 2026

What is CVE-2026-9780?

The vulnerability within Quest NetVault Backup's addclient3 webpage allows remote attackers to execute cross-site scripting attacks by bypassing authentication. This flaw arises from inadequate validation of user-supplied input, enabling the injection of arbitrary scripts. Successful exploitation requires user interaction, as the target must access a malicious page or file. The implications can lead to code execution within the SYSTEM context, particularly when combined with other vulnerabilities.

Affected Version(s)

NetVault Backup 14.0.1.7

References

https://www.zerodayinitiative.com/advisories/ZDI-26-369/
x_research-advisory
https://support.quest.com/technical-documents/netvault/14...
vendor-advisory

CVSS V3.0

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.