What is the CVSS score of CVE-2026-9783?

CVE-2026-9783 has a CVSS 3.0 base score of 8.8 (High). CVSS vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.7%.

Which versions of Quest NetVault Backup are affected by CVE-2026-9783?

A vulnerability in Quest NetVault Backup enables unauthorized remote control of backup systems with elevated privileges, directly threatening backup integrity and disaster recovery capabilities.

How to fix or mitigate CVE-2026-9783?

Within 24 hours: Restrict network access to all Quest NetVault Backup servers to authorized networks only, and review access/backup logs for exploitation attempts. Within 7 days: Deploy firewall rules enforcing IP-based access controls to backup systems, disable unnecessary remote access features, and implement alerting on suspicious activity. Within 30 days: Contact Quest Software for patch availability and timeline; prepare and deploy patched version to all NetVault Backup installations.

Quest NetVault Backup CVE-2026-9783

EUVD-2026-39144 HIGH

SQL Injection (CWE-89)

2026-06-25 zdi-disclosures@trendmicro.com

GHSA-2gj9-425g-wxfr

RCE SQLi Netvault Backup Quest

8.8

CVSS 3.0 · Vendor: trendmicro

Severity by source

Vendor (trendmicro) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network-facing JSON-RPC service with low complexity; authentication is required but bypassable so PR:L is retained, and SQLi-to-RCE as a service account yields full C/I/A impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (trendmicro).

CVSS VectorVendor: trendmicro

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 25, 2026 - 00:30 vuln.today

DescriptionCVE.org

Quest NetVault Backup NVBURemovableMedia SQL Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Quest NetVault Backup. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed.

The specific flaw exists within the processing of NVBURemovableMedia JSON-RPC messages. The issue results from the lack of proper validation of a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to execute code in the context of NETWORK SERVICE. Was ZDI-CAN-27632.

AnalysisAI

SQL injection leading to remote code execution affects Quest NetVault Backup, where the NVBURemovableMedia component fails to validate a user-supplied string before constructing SQL queries. Although authentication is nominally required, ZDI notes the existing authentication mechanism can be bypassed, effectively lowering the barrier to network-based attackers who can then execute code in the context of the NETWORK SERVICE account. No public exploit identified at time of analysis; the issue was reported privately by Trend Micro's Zero Day Initiative (ZDI-CAN-27632 / ZDI-26-372).

Technical ContextAI

Quest NetVault Backup is enterprise data-protection and backup management software that exposes a management service handling JSON-RPC messages. The flaw resides in the NVBURemovableMedia handler, which processes JSON-RPC requests and incorporates a caller-supplied string directly into a SQL query without proper sanitization or parameterization - the classic CWE-89 (Improper Neutralization of Special Elements used in an SQL Command) root cause. Because the backend database and service permit query-borne code execution (e.g., via stacked queries, stored procedures, or file/command primitives exposed by the DBMS), the SQL injection escalates from data manipulation to arbitrary code execution running as NETWORK SERVICE, the Windows account under which the NetVault service operates.

RemediationAI

Upgrade to the fixed Quest NetVault Backup release referenced in the vendor advisory - the Quest release notes for NetVault 14.0.2 (https://support.quest.com/technical-documents/netvault/14.0.2/release-notes#TOPIC-2338529) are cited as the remediation source, so apply that 14.0.2 (or later) build per Quest's guidance and cross-check the ZDI advisory at https://www.zerodayinitiative.com/advisories/ZDI-26-372/. The exact patched version string is not independently confirmed beyond the 14.0.2 release-notes reference, so verify the precise fixed build with Quest before deployment. As compensating controls until patched, restrict network access to the NetVault management/JSON-RPC service ports so that only trusted backup-administration hosts can reach it (network segmentation or host firewall allow-listing) - this reduces exposure but may break remote management consoles or distributed clients that legitimately connect; additionally, monitor the NetVault service and its database for anomalous queries or unexpected NETWORK SERVICE process activity. Avoid exposing the NetVault management interface to untrusted networks or the internet.