What is the CVSS score of CVE-2026-9782?

CVE-2026-9782 has a CVSS 3.0 base score of 8.8 (High). CVSS vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.7%.

Which versions of Quest NetVault Backup are affected by CVE-2026-9782?

Quest NetVault Backup contains an unauthenticated remote code execution vulnerability (CVE-2026-9782, CVSS 8.8) via SQL injection in JSON-RPC message handling; attackers can bypass authentication and…

How to fix or mitigate CVE-2026-9782?

Within 24 hours: Inventory all Quest NetVault Backup instances, immediately restrict network access to JSON-RPC interfaces (port 1610) to trusted networks only, enable enhanced logging for NVBUDeviceDrive requests, and contact Quest Software for patch timeline. Within 7 days: Implement network segmentation isolating backup systems, disable remote JSON-RPC access where operationally feasible, deploy WAF rules blocking SQL injection patterns in JSON-RPC payloads, and assess which systems and data are at risk. Within 30 days: Establish continuous monitoring for suspicious JSON-RPC activity, immediately deploy vendor patch upon release, validate all compensating controls, and verify backup integrity on critical datasets.

Quest NetVault Backup CVE-2026-9782

EUVD-2026-39142 HIGH

SQL Injection (CWE-89)

2026-06-25 zdi-disclosures@trendmicro.com

GHSA-vm9v-g522-qr6w

RCE SQLi Netvault Backup Quest

8.8

CVSS 3.0 · Vendor: trendmicro

Severity by source

Vendor (trendmicro) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network JSON-RPC reachability and low complexity (AV:N/AC:L); PR:L retained because nominal auth exists though bypassable; full RCE as NETWORK SERVICE gives C:H/I:H/A:H.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (trendmicro).

CVSS VectorVendor: trendmicro

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 25, 2026 - 00:30 vuln.today

DescriptionCVE.org

Quest NetVault Backup NVBUDeviceDrive SQL Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Quest NetVault Backup. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed.

The specific flaw exists within the processing of NVBUDeviceDrive JSON-RPC messages. The issue results from the lack of proper validation of a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to execute code in the context of NETWORK SERVICE. Was ZDI-CAN-27633.

AnalysisAI

Remote code execution in Quest NetVault Backup arises from SQL injection in the NVBUDeviceDrive JSON-RPC message handler, where a user-supplied string is concatenated into a SQL query without validation (CWE-89). Although the product requires authentication, the existing authentication mechanism can be bypassed, so remote attackers can reach the flaw and execute arbitrary code in the context of the NETWORK SERVICE account. Discovered and reported through Trend Micro's Zero Day Initiative (ZDI-26-371, formerly ZDI-CAN-27633); no public exploit identified at time of analysis and the CVE is not listed in CISA KEV.

Technical ContextAI

NetVault Backup is Quest's enterprise data-protection/backup platform that exposes management functions over a JSON-RPC interface. The defect is a classic SQL injection (CWE-89): the NVBUDeviceDrive component parses JSON-RPC messages and uses an attacker-controlled string directly in the construction of a SQL statement, allowing query syntax to be broken out of. Because the backend service runs with the Windows NETWORK SERVICE identity and the injection reaches a database layer capable of command execution (e.g., via stacked queries or DB-to-OS functionality), the SQLi escalates from data manipulation to full remote code execution. No specific CPE strings were supplied in the intelligence, so exact affected build numbers must be confirmed from the vendor release notes.

RemediationAI

Upgrade to the fixed release per the vendor advisory - the referenced Quest NetVault Backup 14.0.2 release notes (https://support.quest.com/technical-documents/netvault/14.0.2/release-notes#TOPIC-2338529) indicate the corrected version, and the ZDI advisory ZDI-26-371 (https://www.zerodayinitiative.com/advisories/ZDI-26-371/) should be reviewed to confirm the exact patched build for your deployment. Until patched, reduce exposure of the JSON-RPC management interface: restrict network access to the NetVault management/RPC ports to trusted backup-administration hosts only (firewall/ACL or VPN segmentation), which prevents arbitrary remote clients from reaching NVBUDeviceDrive at the cost of requiring jump-host access for legitimate admins. Because the authentication mechanism itself can be bypassed, do not rely on application credentials as a control; network-level isolation and monitoring of the NETWORK SERVICE account for anomalous process spawning are the meaningful compensating controls. Do not expose NetVault management interfaces to the internet.