Quest NetVault Backup CVE-2026-9782

The attacker must be able to reach the NetVault Backup JSON-RPC interface over the network and deliver a crafted NVBUDeviceDrive message; the vulnerable input is a user-supplied string used to build a SQL query. The CVSS vector encodes PR:L (some authentication), but the description states the existing authentication mechanism can be bypassed, so a valid account is not a hard prerequisite - this is the key limiting factor that defenders should treat as effectively removed. No user interaction is required (UI:N) and attack complexity is low (AC:L). The practical limiter is network exposure of the NetVault management/RPC service: instances segmented behind firewalls or VPNs are far harder to reach than internet- or LAN-exposed ones. Successful RCE runs in the context of the NETWORK SERVICE account, bounding the immediate privilege level on the host.

Signals are consistent and point to a real priority. The CVSS 3.0 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 8.8) indicates a network-reachable, low-complexity, low-privilege attack with full confidentiality, integrity, and availability impact. The description materially worsens the PR:L assumption: it explicitly states the authentication mechanism can be bypassed, which effectively lowers the practical barrier toward unauthenticated access and should raise prioritization above what the raw 8.8 suggests. EPSS and SSVC scoring were not provided in the input, and the vulnerability is not in CISA KEV, so there is no evidence of active exploitation; likewise no POC was supplied. The conflict to flag explicitly: CVSS encodes PR:L (authenticated) yet the description describes an auth bypass - defenders should treat realistic exploitability as closer to unauthenticated. Net: high-priority patch candidate for any internet- or network-exposed NetVault instance, even though widespread exploitation is not yet confirmed.

An attacker with network reachability to the NetVault Backup service abuses the authentication bypass to gain access, then sends a crafted NVBUDeviceDrive JSON-RPC message containing a malicious SQL fragment in a user-supplied field. The injected query executes against the backend database and is leveraged to run operating-system commands, giving the attacker code execution as NETWORK SERVICE. No public POC was provided in the intelligence, but the low attack complexity (AC:L) makes reliable exploitation plausible once interface access is obtained.