CVE-2026-9785: Quest NetVault Backup SQL Injection RCE Vulnerability

Technical summary

The vulnerability exists in Quest NetVault Backup's handling of NVBULibrarySlot JSON-RPC requests. The application fails to properly sanitize user-supplied string input before incorporating it into dynamically constructed SQL queries. This classic SQL injection flaw (CWE-89) allows an attacker to break out of the intended query context, inject arbitrary SQL commands, and ultimately achieve remote code execution. The CVSS 3.0 score of 8.8 (HIGH) reflects the network-accessible attack vector, low attack complexity, and the ability to compromise confidentiality, integrity, and availability. The vulnerability was originally tracked as ZDI-CAN-27630 before CVE assignment.

Business impact

NetVault Backup is a critical infrastructure component responsible for protecting organizational data. Compromise via this vulnerability exposes backup systems to theft, encryption (ransomware), deletion, or corruption of backup data—potentially rendering disaster recovery capabilities inoperable. An attacker gaining code execution in the NETWORK SERVICE context can access database credentials, manipulate backup content, exfiltrate sensitive data, and potentially pivot to other systems on the network that trust the backup server.

Affected systems

Quest NetVault Backup installations are affected. The exact affected versions have not been specified in the available advisory data; verify the vendor's official security bulletin to confirm which product versions require patching and whether patches are currently available.

Exploitability

Although authentication is nominally required, the vulnerability description indicates the authentication mechanism can be bypassed. This significantly lowers the barrier to exploitation. Network access is required, but given that backup systems are often accessible from multiple network segments or remotely, this is a practical attack surface. No public exploit code has been included in this analysis, and there is no indication this vulnerability has been added to any active exploit database or ransomware toolkit.

Remediation

Apply the security patch released by Quest for this vulnerability as soon as possible. Organizations should prioritize this over less critical updates due to the backup system's role in business continuity. Additionally, review network access controls to backup systems to ensure they are restricted to necessary administrative and backup client systems. Verify that the authentication bypass cannot be exploited by testing your environment after patching.

Patch guidance

Contact Quest for the specific patch version addressing CVE-2026-9785. The vendor advisory will detail supported product versions and whether patches are available or planned. Given the HIGH severity and the bypass of authentication, patching should occur within days of availability. Test patches in a non-production environment before deployment. After patching, restart NetVault Backup services and verify functionality.

Detection guidance

Monitor NetVault Backup application logs for suspicious NVBULibrarySlot JSON-RPC requests containing unusual SQL syntax or string patterns (semicolons, SQL keywords, comment sequences). Query database logs for unexpected administrative-level commands issued by the backup service account. Watch for unexpected code execution or spawning of child processes under the NETWORK SERVICE account on the backup server. Monitor for data exfiltration or unusual network traffic from the backup server to external hosts.

Why prioritize this

This vulnerability should be prioritized for immediate patching. It targets a critical infrastructure system (backup), allows remote code execution despite nominal authentication requirements, has a HIGH CVSS score, and provides an attacker with system-level privileges. The inability to recover from ransomware or data loss if the backup system is compromised makes this threat existential to business continuity.

Risk score, explained

The CVSS 3.0 score of 8.8 (HIGH) reflects a network-accessible vulnerability with low attack complexity that fully compromises confidentiality, integrity, and availability. While the score accounts for an 'L' privilege requirement (authentication), the fact that authentication can be bypassed elevates practical risk beyond the numerical score. No mitigating factors such as user interaction, scope limitation, or availability complexity are present.

Frequently asked questions