EUVD-2026-39140
GHSA-rhv6-pj5x-4qfc
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Reflected XSS needing victim interaction (UI:R) crosses a security boundary into the auth context (S:C) with limited direct C/I impact; the SYSTEM-level C/I/A:H outcome depends on a separate chained vulnerability not scored here.
Primary rating from Vendor (trendmicro).
CVSS VectorVendor: trendmicro
Lifecycle Timeline
1DescriptionCVE.org
Quest NetVault Backup addclient3 Cross-Site Scripting Authentication Bypass Vulnerability. This vulnerability allows remote attackers to bypass authentication on affected installations of Quest NetVault Backup. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.
The specific flaw exists within the addclient3 webpage. The issue results from the lack of proper validation of user-supplied data, which can lead to the injection of an arbitrary script. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-27666.
AnalysisAI
Authentication bypass via cross-site scripting in Quest NetVault Backup's addclient3 webpage allows remote attackers to inject arbitrary script that executes in a victim's authenticated session, bypassing access controls. Disclosed through Trend Micro's Zero Day Initiative (ZDI-26-369, formerly ZDI-CAN-27666), the flaw requires user interaction - the target must visit a malicious page or open a malicious file - and can be chained with other weaknesses to achieve code execution in the SYSTEM context. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV, though the high CVSS of 8.8 reflects the serious downstream RCE potential.
Technical ContextAI
Quest NetVault Backup is enterprise data-protection software providing centralized backup and recovery across heterogeneous environments, administered through a web-based console. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation, i.e. cross-site scripting): the addclient3 web endpoint fails to properly validate or encode user-supplied data before reflecting it into a page, permitting injection of attacker-controlled script. Because the script executes within the privileged management interface, it can subvert the application's authentication state and, per ZDI, be leveraged together with additional vulnerabilities to reach the underlying SYSTEM account that the NetVault service runs as.
RemediationAI
Upgrade to Quest NetVault Backup 14.0.2 or later, the version associated with the vendor release notes (https://support.quest.com/technical-documents/netvault/14.0.2/release-notes#TOPIC-2338529); patch availability is per vendor advisory and the exact lowest fixed build should be verified against those notes. Until patched, restrict network exposure of the NetVault management web interface to a trusted administrative network or VPN and place it behind access controls so untrusted clients cannot reach the addclient3 endpoint - the trade-off is reduced remote administrability. Because the attack hinges on user interaction, instruct administrators not to open untrusted links or files while authenticated to the console and consider browser isolation or strict Content-Security-Policy at any fronting proxy to blunt reflected script execution, accepting that a proxy-level CSP may break legitimate console functionality if too restrictive. Cross-reference the ZDI advisory (https://www.zerodayinitiative.com/advisories/ZDI-26-369/) for coordinated-disclosure details.
More in Netvault Backup
View allDell Netvault Backup before 10.0.5 allows remote attackers to cause a denial of service (crash) via a crafted request. R
Integer overflow in the libnv6 module in Dell NetVault Backup before 10.0.5 allows remote attackers to execute arbitrary
This vulnerability allows remote attackers to bypass authentication on vulnerable installations of Quest NetVault Backup
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Quest NetVault Backu
Remote code execution in Quest NetVault Backup allows authenticated remote attackers - who can bypass the product's exis
Remote code execution in Quest NetVault Backup arises through SQL injection in the NVBUDashboard component's JSON-RPC me
Remote code execution in Quest NetVault Backup arises from a SQL injection flaw in the handling of NVBULibrarySlot JSON-
SQL injection in Quest NetVault Backup's NVBULibraryPort JSON-RPC handler allows remote attackers to execute arbitrary c
SQL injection leading to remote code execution affects Quest NetVault Backup, where the NVBURemovableMedia component fai
Remote code execution in Quest NetVault Backup arises from SQL injection in the NVBUDeviceDrive JSON-RPC message handler
Remote code execution in Quest NetVault Backup arises from SQL injection in the NVBURASDevice JSON-RPC message handler,
SQL injection leading to remote code execution in Quest NetVault Backup allows attackers to run arbitrary code as the NE
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today