EUVD-2026-39149
GHSA-j45r-jgvc-p3cw
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Network-delivered reflected XSS needing victim interaction (UI:R, PR:N); scope changes to the victim's session (S:C) with limited direct C/I and no availability impact for the XSS primitive alone, since SYSTEM RCE requires chaining other bugs.
Primary rating from Vendor (trendmicro).
CVSS VectorVendor: trendmicro
Lifecycle Timeline
1DescriptionCVE.org
Quest NetVault Backup viewclient Cross-Site Scripting Authentication Bypass Vulnerability. This vulnerability allows remote attackers to bypass authentication on affected installations of Quest NetVault Backup. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.
The specific flaw exists within the viewclient webpage. The issue results from the lack of proper validation of user-supplied data, which can lead to the injection of an arbitrary script. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-28202.
AnalysisAI
Authentication bypass via cross-site scripting in the Quest NetVault Backup viewclient web interface lets remote attackers inject arbitrary script that, when a victim visits a malicious page or opens a malicious file, runs in the application context and circumvents authentication. Disclosed through Trend Micro's Zero Day Initiative (ZDI-26-377, ZDI-CAN-28202), the flaw can be chained with additional vulnerabilities to achieve code execution as SYSTEM. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the CVSS 8.8 rating reflects the high impact of the auth-bypass-plus-RCE chain.
Technical ContextAI
Quest NetVault Backup is an enterprise data-protection/backup platform with a web-based management console. The vulnerability lives in the viewclient webpage, which fails to properly validate or encode user-supplied data before reflecting it, the classic root cause of CWE-79 (Improper Neutralization of Input During Web Page Generation, i.e. Cross-Site Scripting). Because the injected script executes within the trusted origin of the NetVault management UI, it can manipulate authenticated session state and effectively bypass authentication controls. ZDI tags this as Authentication Bypass + RCE + XSS because the script injection serves as the initial primitive that, combined with other weaknesses, escalates to arbitrary code execution in the SYSTEM context on the underlying host. No CPE strings were supplied in the intelligence, so exact affected configurations must be derived from the vendor release notes rather than NVD CPE data.
RemediationAI
Upgrade Quest NetVault Backup to the fixed release indicated in the vendor's 14.0.2 release notes (https://support.quest.com/technical-documents/netvault/14.0.2/release-notes#TOPIC-2338529) and cross-reference the ZDI advisory at https://www.zerodayinitiative.com/advisories/ZDI-26-377/ to confirm the patched build; patch available per vendor advisory, with the exact remediated build to be verified against those release notes before deployment. Because exploitation depends on a NetVault operator visiting a malicious page, compensating controls until patching include restricting network access to the NetVault management web interface to a dedicated admin VLAN or jump host (trade-off: legitimate remote administration becomes harder and may require VPN/bastion changes), enforcing that administrators do not browse untrusted web content or open untrusted files from the same session/host used to access the console (trade-off: operational/workflow friction), and placing the viewclient endpoint behind a reverse proxy or WAF with reflected-XSS filtering on its parameters (trade-off: WAF rules can be bypassed and may break legitimate console functionality if too aggressive). Avoid exposing the NetVault console to the public internet.
More in Netvault Backup
View allDell Netvault Backup before 10.0.5 allows remote attackers to cause a denial of service (crash) via a crafted request. R
Integer overflow in the libnv6 module in Dell NetVault Backup before 10.0.5 allows remote attackers to execute arbitrary
This vulnerability allows remote attackers to bypass authentication on vulnerable installations of Quest NetVault Backup
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Quest NetVault Backu
Remote code execution in Quest NetVault Backup allows authenticated remote attackers - who can bypass the product's exis
Remote code execution in Quest NetVault Backup arises through SQL injection in the NVBUDashboard component's JSON-RPC me
Remote code execution in Quest NetVault Backup arises from a SQL injection flaw in the handling of NVBULibrarySlot JSON-
SQL injection in Quest NetVault Backup's NVBULibraryPort JSON-RPC handler allows remote attackers to execute arbitrary c
SQL injection leading to remote code execution affects Quest NetVault Backup, where the NVBURemovableMedia component fai
Remote code execution in Quest NetVault Backup arises from SQL injection in the NVBUDeviceDrive JSON-RPC message handler
Remote code execution in Quest NetVault Backup arises from SQL injection in the NVBURASDevice JSON-RPC message handler,
SQL injection leading to remote code execution in Quest NetVault Backup allows attackers to run arbitrary code as the NE
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today