EUVD-2026-39140
GHSA-rhv6-pj5x-4qfc
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Reflected XSS needing victim interaction (UI:R) crosses a security boundary into the auth context (S:C) with limited direct C/I impact; the SYSTEM-level C/I/A:H outcome depends on a separate chained vulnerability not scored here.
Primary rating from Vendor (trendmicro).
CVSS VectorVendor: trendmicro
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Lifecycle Timeline
1DescriptionCVE.org
Quest NetVault Backup addclient3 Cross-Site Scripting Authentication Bypass Vulnerability. This vulnerability allows remote attackers to bypass authentication on affected installations of Quest NetVault Backup. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.
The specific flaw exists within the addclient3 webpage. The issue results from the lack of proper validation of user-supplied data, which can lead to the injection of an arbitrary script. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-27666.
AnalysisAI
Authentication bypass via cross-site scripting in Quest NetVault Backup's addclient3 webpage allows remote attackers to inject arbitrary script that executes in a victim's authenticated session, bypassing access controls. Disclosed through Trend Micro's Zero Day Initiative (ZDI-26-369, formerly ZDI-CAN-27666), the flaw requires user interaction - the target must visit a malicious page or open a malicious file - and can be chained with other weaknesses to achieve code execution in the SYSTEM context. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the victim - a user with access to the NetVault Backup web console - to visit an attacker-controlled malicious page or open a malicious file (CVSS UI:R), which triggers the unvalidated input handling in the addclient3 webpage; achieving the full SYSTEM-level impact additionally requires chaining with at least one other vulnerability, as the XSS/auth-bypass alone does not directly yield code execution. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS:3.0 vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H yields 8.8 (High): network-reachable, low complexity, no privileges required, but mandatory user interaction (UI:R) is the principal limiting factor - exploitation depends on luring an administrator/operator to attacker-controlled content rather than a fully autonomous remote attack. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker crafts a malicious web page (or file) containing script targeting the addclient3 endpoint and entices a NetVault administrator to open it while logged into the console. The reflected script runs in the administrator's authenticated session, bypassing authentication controls, and - combined with a secondary flaw - pivots to arbitrary code execution as SYSTEM on the backup server. … |
| Remediation | Upgrade to Quest NetVault Backup 14.0.2 or later, the version associated with the vendor release notes (https://support.quest.com/technical-documents/netvault/14.0.2/release-notes#TOPIC-2338529); patch availability is per vendor advisory and the exact lowest fixed build should be verified against those notes. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
24 hours: Inventory all Quest NetVault Backup deployments; immediately restrict network access to the addclient3 interface to authorized administrative networks only and disable client self-registration if not operationally required. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Netvault Backup
View allDell Netvault Backup before 10.0.5 allows remote attackers to cause a denial of service (crash) via a crafted request. R
Integer overflow in the libnv6 module in Dell NetVault Backup before 10.0.5 allows remote attackers to execute arbitrary
This vulnerability allows remote attackers to bypass authentication on vulnerable installations of Quest NetVault Backup
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Quest NetVault Backu
Remote code execution in Quest NetVault Backup allows authenticated remote attackers - who can bypass the product's exis
Remote code execution in Quest NetVault Backup arises through SQL injection in the NVBUDashboard component's JSON-RPC me
Remote code execution in Quest NetVault Backup arises from a SQL injection flaw in the handling of NVBULibrarySlot JSON-
SQL injection in Quest NetVault Backup's NVBULibraryPort JSON-RPC handler allows remote attackers to execute arbitrary c
SQL injection leading to remote code execution affects Quest NetVault Backup, where the NVBURemovableMedia component fai
Remote code execution in Quest NetVault Backup arises from SQL injection in the NVBUDeviceDrive JSON-RPC message handler
Remote code execution in Quest NetVault Backup arises from SQL injection in the NVBURASDevice JSON-RPC message handler,
SQL injection leading to remote code execution in Quest NetVault Backup allows attackers to run arbitrary code as the NE
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today