Quest NetVault Backup CVE-2026-9784

Exploitation requires network access to the NetVault Backup NVBULibraryPort JSON-RPC service and the ability to submit a crafted JSON-RPC message with an attacker-controlled string that is concatenated into a SQL query. The CVSS vector lists PR:L (some authentication), but the ZDI advisory explicitly states the existing authentication mechanism can be bypassed, so valid credentials may not be a hard prerequisite. No user interaction is required (UI:N). The principal limiting factor is reachability of the NVBULibraryPort service: deployments that firewall or segment this listener to trusted hosts substantially raise the bar; the affected component runs as NETWORK SERVICE on the NetVault host.

The CVSS 3.0 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, score 8.8 High) indicates a low-complexity, network-reachable attack with full confidentiality, integrity, and availability impact requiring only low privileges. The significant aggravating factor is that the ZDI advisory states the authentication requirement can be bypassed, which in practice may erode the PR:L barrier toward unauthenticated reach - this conflict between the formal PR:L vector and the described bypass should be verified against the vendor advisory. No EPSS score was provided in the input, and there is no CISA KEV listing or public POC, so there is currently no evidence of active or widespread exploitation. Net assessment: a genuinely high-priority RCE in security-relevant backup infrastructure that warrants prompt patching, tempered by the absence (so far) of confirmed in-the-wild activity.

An attacker with network reach to the NetVault Backup service crafts a malicious NVBULibraryPort JSON-RPC message containing a SQL injection payload in a user-controlled string field, and leverages the described authentication bypass to deliver it without valid credentials. The injected SQL executes in a context that permits command execution, yielding arbitrary code execution as NETWORK SERVICE. No public exploit code has been identified at time of analysis, and given AC:L the attack is low-complexity once the message format is known.