Quest NetVault Backup CVE-2026-9781

Exploitation requires network reachability to the NetVault Backup NVBURASDevice JSON-RPC service endpoint. Authentication is nominally required (CVSS PR:L), but the advisory states the existing authentication mechanism can be bypassed, which removes valid credentials as a meaningful barrier. No user interaction is needed (UI:N) and attack complexity is low (AC:L). The main limiting factors are that the attacker must be able to send JSON-RPC traffic to the specific NVBURASDevice listener (so network exposure of the backup management service is the key gating condition) and that the target must be a vulnerable, unpatched build running the NETWORK SERVICE-context backend (consistent with a Windows deployment).

The CVSS 3.0 base score is 8.8 (High) with vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - network-reachable, low complexity, low privileges, no user interaction, with full confidentiality, integrity, and availability impact. The PR:L rating reflects that authentication is normally required, but the advisory explicitly states the authentication mechanism can be bypassed, which in practice pushes real-world exploitability closer to unauthenticated and argues for prioritized patching. EPSS data was not provided, and the CVE is not in CISA KEV, so there is no evidence of active exploitation; combined with no identified public exploit, this currently reads as a high-severity but not-yet-weaponized issue. The primary risk driver is the combination of an auth bypass plus RCE on a backup server - a high-value target - rather than confirmed in-the-wild activity.

An attacker who can reach the NetVault Backup server over the network leverages the authentication bypass to submit a crafted NVBURASDevice JSON-RPC message containing a malicious SQL payload. The injection is processed by the backend database and abused to execute arbitrary commands, giving the attacker code execution as NETWORK SERVICE on the backup host. No public proof-of-concept is identified at time of analysis, but the low attack complexity makes reliable exploitation plausible once details are known.