Quest NetVault Backup CVE-2026-7569

Exploitation requires that a NetVault Backup user/administrator with access to the management interface be socially engineered into visiting an attacker-controlled web page or opening a malicious file (UI:R) that targets the viewclient webpage; the injected script then leverages the lack of input validation to bypass authentication. No attacker authentication or pre-existing privileges are needed (PR:N), and the attack is network-delivered (AV:N) with low complexity (AC:L). The key limiting factors are the mandatory victim interaction, the need for the victim to have access to a reachable NetVault viewclient instance, and that full SYSTEM code execution is achieved only 'in conjunction with other vulnerabilities' - this CVE alone provides the XSS/auth-bypass primitive, not standalone RCE.

The CVSS:3.0 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) indicates a network-reachable, low-complexity attack requiring no attacker privileges but mandatory victim interaction, with high confidentiality, integrity, and availability impact. The single most important mitigating signal is UI:R: an administrator or operator must be lured into visiting a malicious page or opening a malicious file, which makes this a social-engineering-dependent attack rather than a wormable, fully unauthenticated server-side flaw. No EPSS score was provided, the CVE is not in CISA KEV, and no POC is referenced, so all exploitation signals currently point to no confirmed real-world exploitation. The high C/I/A and the RCE-as-SYSTEM chaining claim come from ZDI's analysis and warrant priority patching for internet- or intranet-exposed NetVault consoles, but the requirement for user interaction and chaining with other bugs tempers the immediacy versus a no-interaction critical. Note a minor inconsistency to verify: a pure reflected XSS would more typically carry a scope change (S:C) and lower direct C/I/A, whereas ZDI's S:U with full high impacts reflects the broader auth-bypass/RCE chain rather than the XSS alone.

An attacker crafts a malicious URL or file containing a script payload targeting the NetVault viewclient page and sends it to a NetVault administrator via phishing. When the admin opens it, the script executes in the trusted context of the NetVault UI, bypassing authentication, and the attacker chains it with additional flaws to run code as SYSTEM on the backup server. No public exploit is identified at time of analysis, and the low attack complexity means a single successful lure is sufficient to begin the chain.