CVE-2026-9780: Quest NetVault Backup Authentication Bypass & XSS Vulnerability

Technical summary

CVE-2026-9780 is a reflected or stored XSS vulnerability (CWE-79) in the addclient3 component of Quest NetVault Backup. The vulnerability stems from insufficient input validation and output encoding of user-supplied data in the addclient3 webpage. An attacker can inject arbitrary JavaScript that executes in the victim's browser context. When combined with other attack vectors or misconfigurations, this XSS can be leveraged to bypass authentication controls and ultimately achieve arbitrary code execution in the SYSTEM security context. The CVSS 3.0 score of 8.8 (HIGH) reflects the high impact to confidentiality, integrity, and availability, though exploitation requires user interaction and no special privileges.

Business impact

A successful exploit could allow attackers to gain unauthorized administrative access to NetVault Backup, potentially leading to theft, modification, or deletion of critical backup data. Given that NetVault Backup is typically deployed to protect an organization's recovery capabilities, compromise of the backup infrastructure represents a severe business continuity and data protection risk. Attackers could exfiltrate sensitive backups, prevent recovery operations, or plant persistent backdoors throughout an organization's backup footprint.

Affected systems

Quest NetVault Backup installations are affected. The vulnerability specifically targets the addclient3 webpage component. Organizations running NetVault Backup should inventory their deployments and version numbers to determine exposure. Consult Quest's security advisory for the specific affected version ranges and any patch availability.

Exploitability

This vulnerability requires user interaction—a target must visit a malicious webpage or open a malicious file. It is not exploitable without social engineering or supply-chain compromise. However, once a user is tricked into visiting a malicious site or opening a file, exploitation is straightforward: the attacker injects a script payload into the addclient3 parameter, which executes in the user's browser and bypasses authentication. The attack surface is broad because it leverages web browsers, which are ubiquitous. This vulnerability is not currently listed on CISA's Known Exploited Vulnerabilities (KEV) catalog, but the combination of XSS, authentication bypass, and SYSTEM-level code execution potential makes it an attractive target for adversaries.

Remediation

Quest should issue a patch that implements proper input validation and output encoding for the addclient3 webpage. Organizations must apply vendor patches promptly. In the interim, consider restricting network access to the NetVault Backup addclient3 interface, disabling the component if not in use, or deploying web application firewalls (WAF) rules to filter malicious XSS payloads. Educate users and administrators to avoid clicking suspicious links or opening untrusted files that reference NetVault Backup interfaces.

Patch guidance

Monitor Quest's security advisories and knowledge base for patches addressing CVE-2026-9780. When patches are released, prioritize deployment in your NetVault Backup environment. Test patches in a non-production environment first to ensure compatibility with your backup workflows and dependent systems. Verify patch application by checking component versions and, where possible, confirming that the vulnerable addclient3 parameter is now properly sanitized. Maintain a list of all NetVault Backup instances to track patch rollout progress.

Detection guidance

Monitor web server logs and proxy logs for suspicious requests to the addclient3 endpoint containing encoded or obfuscated script tags, JavaScript event handlers (e.g., onerror, onload), or other XSS payloads. Look for requests with unusual parameter values, especially those containing HTML or JavaScript characters. Implement browser-based detection: monitor for unexpected JavaScript execution originating from the NetVault Backup interface. Endpoint detection and response (EDR) tools should alert on SYSTEM-level process spawning from the NetVault service, which could indicate successful XSS-to-RCE exploitation. Review authentication logs for sessions that bypass normal credential checks.

Why prioritize this

A CVSS 8.8 HIGH vulnerability affecting backup infrastructure demands immediate attention. The combination of authentication bypass and SYSTEM-level code execution creates a path to critical compromise. Although user interaction is required, the impact is severe: attackers could disable backups, exfiltrate data, or establish persistent footholds. NetVault Backup is a crown-jewel system in most enterprises, making this vulnerability particularly dangerous. Organizations should treat this with high priority and patch as soon as vendor guidance is available.

Risk score, explained

The 8.8 CVSS score reflects HIGH severity due to maximum impact to confidentiality, integrity, and availability (all scored as High in the vector), combined with network-accessible, low-complexity exploitation. The score is tempered by the requirement for user interaction and the fact that exploitation requires the victim to visit a malicious site or open a file. However, the vector (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) indicates that once the user clicks, an attacker with no privileges can fully compromise the targeted NetVault instance. Organizations with mature backup security postures and user awareness training may reduce practical risk; those without will face elevated risk.

Frequently asked questions