Quest NetVault Backup CVE-2026-9785

Exploitation requires network reachability to the NetVault Backup management service that processes JSON-RPC messages, and specifically the ability to send an NVBULibrarySlot request carrying an attacker-controlled string that is used to build a SQL query. The CVSS vector lists PR:L (authentication required), but ZDI explicitly states the existing authentication mechanism can be bypassed, so valid credentials are not a hard prerequisite in practice. No user interaction is needed (UI:N) and attack complexity is low (AC:L). The principal limiting factors are reachability of the NetVault management service from the attacker's network position and the specific NVBULibrarySlot code path being present in the installed (unpatched) version; resulting impact is bounded to the NETWORK SERVICE account context rather than immediate SYSTEM/administrator.

The supplied CVSS 3.0 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 8.8) describes a network-reachable, low-complexity flaw needing only low-privilege authentication, with high confidentiality, integrity, and availability impact. The most important signal is qualitative rather than numeric: ZDI states the authentication requirement can be bypassed, which materially lowers the real barrier below what PR:L implies and pushes practical risk toward unauthenticated RCE. Against that, no EPSS score was provided, there is no KEV listing, and no public POC is identified, so there is currently no evidence of active or widespread exploitation - the threat is credible and high-impact but not yet demonstrated in the wild. This is a genuine priority for organizations running NetVault with network- or internet-exposed management services, not a high-CVSS-but-low-real-risk case; however, the absence of EPSS/KEV data means exploitation likelihood is inferred from the vulnerability class and ZDI's auth-bypass note rather than confirmed telemetry.

An attacker with network access to the NetVault Backup management service crafts a malicious NVBULibrarySlot JSON-RPC message containing an injected SQL payload, leveraging the documented authentication bypass to reach the handler without valid credentials. The injected query is escalated to operating-system command execution, giving the attacker code execution as NETWORK SERVICE on the backup server. No public POC is currently identified, but ZDI's analysis confirms the path is exploitable (AV:N/AC:L).