CVE-2026-9786: Quest NetVault Backup SQL Injection Remote Code Execution

Technical summary

CVE-2026-9786 is a SQL injection vulnerability (CWE-89) affecting Quest NetVault Backup's NVBUDashboard functionality. The vulnerability exists in the JSON-RPC message handler, which fails to properly validate user-supplied input before incorporating it into SQL queries. An attacker who either possesses valid credentials or successfully bypasses authentication can inject malicious SQL code. This injection can be leveraged to execute arbitrary code in the security context of the NETWORK SERVICE account, resulting in full system compromise. The vulnerability was originally tracked as ZDI-CAN-27626 before CVE assignment.

Business impact

Exploitation of this vulnerability could allow an attacker to gain code execution on NetVault Backup infrastructure with NETWORK SERVICE privileges. Given that NetVault Backup typically manages critical backup and recovery operations, compromise could lead to data theft, data destruction, operational downtime, and potential inability to restore systems. The authentication bypass aspect significantly expands the threat surface, as attackers need not obtain legitimate credentials. Organizations relying on NetVault Backup for disaster recovery face elevated risk of business continuity disruption.

Affected systems

Quest NetVault Backup installations are affected by this vulnerability. The specific affected versions are not detailed in the available source data; organizations should consult Quest's official advisory to determine which releases contain the flaw and which patches resolve it.

Exploitability

The vulnerability carries a CVSS 3.0 score of 8.8 (HIGH severity) with a vector of AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. This indicates the vulnerability is remotely exploitable over the network with low attack complexity and no user interaction required. Although the CVSS vector specifies PR:L (low privilege requirement), the presence of an authentication bypass mechanism in the same component makes exploitation practical for unauthenticated attackers as well. The lack of KEV listing suggests no public active exploitation has been formally documented at the time of initial disclosure, but organizations should not rely on this as an indicator of low risk.

Remediation

Organizations must promptly apply security patches from Quest that address this SQL injection flaw. Verify the specific patch versions applicable to your deployed NetVault Backup releases by consulting Quest's security advisory. Until patches can be applied, consider restricting network access to the NVBUDashboard component, limiting exposure to trusted internal networks only, and monitoring for suspicious JSON-RPC activity.

Patch guidance

Apply the security update provided by Quest for your specific NetVault Backup version. Patch availability and version numbers should be verified directly from Quest's official security advisory or support portal. After patching, validate that the update has been applied across all NetVault Backup instances in your environment, including distributed backup clients and central management servers. Test functionality in a non-production environment before broad deployment.

Detection guidance

Monitor network traffic for suspicious JSON-RPC requests to the NVBUDashboard component, particularly those containing SQL keywords or special characters in JSON payloads. Examine application logs for unexpected SQL errors or query patterns originating from the NVBUDashboard module. Verify that NETWORK SERVICE account activity is limited to expected backup operations; unusual code execution or file system modifications under this account warrant investigation. Watch for attempts to authenticate with invalid credentials followed by rapid exploitation attempts, which may indicate authentication bypass attempts.

Why prioritize this

This vulnerability merits immediate attention due to its combination of high CVSS score (8.8), remote exploitability, code execution impact, and the presence of an authentication bypass. Organizations should prioritize patching this flaw before other non-critical updates, given the critical role of backup systems in business continuity. The lack of public KEV listing does not reduce urgency, as the vulnerability's inherent severity and practical exploitability warrant proactive remediation.

Risk score, explained

The CVSS 3.0 score of 8.8 reflects the vulnerability's severity across multiple dimensions: remote network access (AV:N), low attack complexity (AC:L), high impact to confidentiality, integrity, and availability (C:H/I:H/A:H), and unchanged scope (S:U). While the vector includes PR:L, the documented authentication bypass significantly amplifies real-world risk, as attackers can circumvent this requirement. This justifies treating the vulnerability as a critical priority despite not appearing on the KEV list.

Frequently asked questions