What is the CVSS score of CVE-2026-9784?

CVE-2026-9784 has a CVSS 3.0 base score of 8.8 (High). CVSS vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.7%.

Which versions of Quest NetVault Backup are affected by CVE-2026-9784?

Quest NetVault Backup contains a critical SQL injection vulnerability (CVE-2026-9784, CVSS 8.8) in its NVBULibraryPort component that enables remote code execution with NETWORK SERVICE privileges.

How to fix or mitigate CVE-2026-9784?

24 hours: Identify and inventory all Quest NetVault Backup installations; assess network exposure and restrict administrative access to NVBULibraryPort services to authorized hosts only. 7 days: Implement network segmentation to limit NVBULibraryPort (TCP 13720) access to trusted administrative networks only; deploy network intrusion detection configured to monitor for SQL injection patterns in JSON-RPC handler traffic. 30 days: Contact Quest Software to establish patch delivery timeline; if no vendor patch is released within 60 days, execute contingency plan including extended network isolation, migration to alternative backup solutions, or temporary disconnection of affected systems from external networks.

Quest NetVault Backup CVE-2026-9784

EUVD-2026-39145 HIGH

SQL Injection (CWE-89)

2026-06-25 zdi-disclosures@trendmicro.com

GHSA-qrh4-m2m7-cgg3

RCE SQLi Netvault Backup Quest

8.8

CVSS 3.0 · Vendor: trendmicro

Severity by source

Vendor (trendmicro) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network-reachable JSON-RPC with low-complexity SQLi; PR:L kept per ZDI despite the noted auth bypass, and code execution as NETWORK SERVICE yields high C/I/A.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (trendmicro).

CVSS VectorVendor: trendmicro

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 25, 2026 - 00:31 vuln.today

DescriptionCVE.org

Quest NetVault Backup NVBULibraryPort SQL Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Quest NetVault Backup. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed.

The specific flaw exists within the processing of NVBULibraryPort JSON-RPC messages. The issue results from the lack of proper validation of a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to execute code in the context of NETWORK SERVICE. Was ZDI-CAN-27631.

AnalysisAI

SQL injection in Quest NetVault Backup's NVBULibraryPort JSON-RPC handler allows remote attackers to execute arbitrary code as NETWORK SERVICE on affected installations. While exploitation nominally requires authentication (CVSS PR:L), the ZDI advisory states the existing authentication mechanism can be bypassed, effectively lowering the barrier to remote attackers. There is no public exploit identified at time of analysis and no CISA KEV listing, but the issue was coordinated through Trend Micro's Zero Day Initiative (ZDI-CAN-27631 / ZDI-26-373) and carries a CVSS 3.0 base score of 8.8.

Technical ContextAI

NetVault Backup is Quest Software's cross-platform enterprise data-protection and backup product. The flaw is rooted in CWE-89 (SQL Injection): the NVBULibraryPort component processes JSON-RPC messages and incorporates a user-supplied string directly into a SQL query without proper validation or parameterization. Because the service/database context permits command execution, the injection is escalated from data tampering into full remote code execution running under the Windows NETWORK SERVICE account. The JSON-RPC message-processing path is network-reachable (AV:N), and the absence of input sanitization on the supplied string is the proximate root cause.

RemediationAI

Upgrade Quest NetVault Backup to version 14.0.2 or later, which addresses this issue per the vendor release notes (https://support.quest.com/technical-documents/netvault/14.0.2/release-notes#TOPIC-2338529); see also ZDI advisory ZDI-26-373 (https://www.zerodayinitiative.com/advisories/ZDI-26-373/). Until the upgrade is applied, restrict network access to the NetVault Backup JSON-RPC/NVBULibraryPort service so only trusted administrative hosts can reach the listener via host firewall rules or network segmentation, accepting that this limits legitimate remote management; tightly control and monitor accounts used to reach the service while recognizing that the described authentication bypass reduces the protection credential controls alone provide. No standalone configuration workaround is documented by the vendor, so patching to 14.0.2 is the authoritative fix.