EUVD-2026-39149
GHSA-j45r-jgvc-p3cw
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Network-delivered reflected XSS needing victim interaction (UI:R, PR:N); scope changes to the victim's session (S:C) with limited direct C/I and no availability impact for the XSS primitive alone, since SYSTEM RCE requires chaining other bugs.
Primary rating from Vendor (trendmicro).
CVSS VectorVendor: trendmicro
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Lifecycle Timeline
1DescriptionCVE.org
Quest NetVault Backup viewclient Cross-Site Scripting Authentication Bypass Vulnerability. This vulnerability allows remote attackers to bypass authentication on affected installations of Quest NetVault Backup. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.
The specific flaw exists within the viewclient webpage. The issue results from the lack of proper validation of user-supplied data, which can lead to the injection of an arbitrary script. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-28202.
AnalysisAI
Authentication bypass via cross-site scripting in the Quest NetVault Backup viewclient web interface lets remote attackers inject arbitrary script that, when a victim visits a malicious page or opens a malicious file, runs in the application context and circumvents authentication. Disclosed through Trend Micro's Zero Day Initiative (ZDI-26-377, ZDI-CAN-28202), the flaw can be chained with additional vulnerabilities to achieve code execution as SYSTEM. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that a NetVault Backup user/administrator with access to the management interface be socially engineered into visiting an attacker-controlled web page or opening a malicious file (UI:R) that targets the viewclient webpage; the injected script then leverages the lack of input validation to bypass authentication. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS:3.0 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) indicates a network-reachable, low-complexity attack requiring no attacker privileges but mandatory victim interaction, with high confidentiality, integrity, and availability impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker crafts a malicious URL or file containing a script payload targeting the NetVault viewclient page and sends it to a NetVault administrator via phishing. When the admin opens it, the script executes in the trusted context of the NetVault UI, bypassing authentication, and the attacker chains it with additional flaws to run code as SYSTEM on the backup server. … |
| Remediation | Upgrade Quest NetVault Backup to the fixed release indicated in the vendor's 14.0.2 release notes (https://support.quest.com/technical-documents/netvault/14.0.2/release-notes#TOPIC-2338529) and cross-reference the ZDI advisory at https://www.zerodayinitiative.com/advisories/ZDI-26-377/ to confirm the patched build; patch available per vendor advisory, with the exact remediated build to be verified against those release notes before deployment. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
24 hours: Map all Quest NetVault Backup viewclient instances; immediately restrict network access to trusted internal networks and authorized administrative IPs using firewall rules. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Netvault Backup
View allDell Netvault Backup before 10.0.5 allows remote attackers to cause a denial of service (crash) via a crafted request. R
Integer overflow in the libnv6 module in Dell NetVault Backup before 10.0.5 allows remote attackers to execute arbitrary
This vulnerability allows remote attackers to bypass authentication on vulnerable installations of Quest NetVault Backup
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Quest NetVault Backu
Remote code execution in Quest NetVault Backup allows authenticated remote attackers - who can bypass the product's exis
Remote code execution in Quest NetVault Backup arises through SQL injection in the NVBUDashboard component's JSON-RPC me
Remote code execution in Quest NetVault Backup arises from a SQL injection flaw in the handling of NVBULibrarySlot JSON-
SQL injection in Quest NetVault Backup's NVBULibraryPort JSON-RPC handler allows remote attackers to execute arbitrary c
SQL injection leading to remote code execution affects Quest NetVault Backup, where the NVBURemovableMedia component fai
Remote code execution in Quest NetVault Backup arises from SQL injection in the NVBUDeviceDrive JSON-RPC message handler
Remote code execution in Quest NetVault Backup arises from SQL injection in the NVBURASDevice JSON-RPC message handler,
SQL injection leading to remote code execution in Quest NetVault Backup allows attackers to run arbitrary code as the NE
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today