Quest NetVault Backup CVE-2026-9780

Exploitation requires the victim - a user with access to the NetVault Backup web console - to visit an attacker-controlled malicious page or open a malicious file (CVSS UI:R), which triggers the unvalidated input handling in the addclient3 webpage; achieving the full SYSTEM-level impact additionally requires chaining with at least one other vulnerability, as the XSS/auth-bypass alone does not directly yield code execution. Limiting factors: mandatory user interaction means no purely autonomous remote compromise, the target must have reachable access to the console, and the highest-impact outcome depends on a separate companion vulnerability rather than this flaw in isolation. No authentication is required of the attacker per PR:N, but the attack succeeds against the session of whoever is induced to interact.

The CVSS:3.0 vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H yields 8.8 (High): network-reachable, low complexity, no privileges required, but mandatory user interaction (UI:R) is the principal limiting factor - exploitation depends on luring an administrator/operator to attacker-controlled content rather than a fully autonomous remote attack. No EPSS score, SSVC decision, or KEV entry was provided in the input, and no proof-of-concept is referenced, so real-world exploitation pressure appears low-to-moderate and likely targeted rather than mass-automatable. Note a common modeling tension: ZDI rated scope unchanged (S:U) with full C/I/A:H, which is generous for a reflected XSS in isolation - the high impact ratings are justified primarily by the stated chaining path to SYSTEM-level code execution, so the severity is contingent on that chain. Treat as a meaningful priority for internet-exposed or shared-network NetVault consoles, but lower urgency than an unauthenticated, no-interaction RCE.

An attacker crafts a malicious web page (or file) containing script targeting the addclient3 endpoint and entices a NetVault administrator to open it while logged into the console. The reflected script runs in the administrator's authenticated session, bypassing authentication controls, and - combined with a secondary flaw - pivots to arbitrary code execution as SYSTEM on the backup server. No public exploit code is identified at time of analysis, so this remains a plausible but not yet commodity attack.