Remote Code Execution Vulnerability in Quest NetVault Backup Products
CVE-2026-9781

8.8HIGH

Key Information:

Vendor

Quest

Status
Netvault Backup
Vendor
CVE Published:
24 June 2026

What is CVE-2026-9781?

The vulnerability in Quest NetVault Backup arises from inadequate validation of user-supplied strings in NVBURASDevice JSON-RPC messages, which can lead to SQL injection attacks. Although authentication is required, attackers can bypass this mechanism to execute arbitrary code in the context of NETWORK SERVICE. This flaw poses a significant risk, as it affects the integrity and availability of sensitive data managed by the affected systems.

Affected Version(s)

NetVault Backup 14.0.0.19

References

https://www.zerodayinitiative.com/advisories/ZDI-26-370/
x_research-advisory
https://support.quest.com/technical-documents/netvault/14...
vendor-advisory

CVSS V3.0

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.