What is the CVSS score of CVE-2026-9786?

CVE-2026-9786 has a CVSS 3.0 base score of 8.8 (High). CVSS vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.7%.

Which versions of Quest NetVault Backup are affected by CVE-2026-9786?

Quest NetVault Backup deployments are vulnerable to remote code execution through a SQL injection flaw in the JSON-RPC interface, with a reported authentication bypass lowering the attack barrier for…

How to fix or mitigate CVE-2026-9786?

24 hours: Scan networks to identify and inventory all Quest NetVault Backup deployments; assess internet exposure of admin interfaces and immediately restrict access to authorized personnel only. 7 days: Implement network segmentation placing backup infrastructure on isolated network segments; enable detailed logging of JSON-RPC requests and database queries; establish SIEM alerting for unusual backup system activity. 30 days: Monitor Quest Software security advisories for patch availability; evaluate architectural changes to reduce external exposure of backup systems; conduct backup validation and test recovery procedures to verify backup integrity and independence.

Quest NetVault Backup CVE-2026-9786

EUVD-2026-39147 HIGH

SQL Injection (CWE-89)

2026-06-25 zdi-disclosures@trendmicro.com

GHSA-qhv7-8f66-468j

RCE SQLi Netvault Backup Quest

8.8

CVSS 3.0 · Vendor: trendmicro

Severity by source

Vendor (trendmicro) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network-reachable JSON-RPC SQLi with low complexity and no user interaction; PR:L for the nominal auth requirement (reported bypass arguably warrants PR:N), full C/I/A impact via code execution.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (trendmicro).

CVSS VectorVendor: trendmicro

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 25, 2026 - 00:32 vuln.today

DescriptionCVE.org

Quest NetVault Backup NVBUDashboard SQL Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Quest NetVault Backup. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed.

The specific flaw exists within the processing of NVBUDashboard JSON-RPC messages. The issue results from the lack of proper validation of a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to execute code in the context of NETWORK SERVICE. Was ZDI-CAN-27626.

AnalysisAI

Remote code execution in Quest NetVault Backup arises through SQL injection in the NVBUDashboard component's JSON-RPC message handler, letting attackers run arbitrary code in the NETWORK SERVICE context. While the flaw nominally requires authentication, ZDI reports the product's authentication mechanism can be bypassed, materially lowering the access bar. No public exploit is identified at time of analysis and the issue is not listed in CISA KEV, but its CVSS 3.0 base score of 8.8 and full-impact (C:H/I:H/A:H) profile mark it as high priority for any exposed deployment.

Technical ContextAI

NetVault Backup is Quest's cross-platform enterprise data-protection and backup management suite; the affected NVBUDashboard is its web-facing dashboard/management interface, which exchanges JSON-RPC messages with the backend. The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command): a user-supplied string carried inside a JSON-RPC request is concatenated into a SQL query without proper validation or parameterization. Because the underlying database service and the NetVault process run with NETWORK SERVICE privileges on Windows, SQL injection escalates from data tampering into command/code execution - typical of database stacked-query or extended-procedure abuse where the injection point yields OS-level execution rather than just data disclosure.

RemediationAI

Upgrade NetVault Backup to the fixed release indicated in the vendor release notes - the references point to NetVault 14.0.2 (https://support.quest.com/technical-documents/netvault/14.0.2/release-notes#TOPIC-2338529), so apply that build or later after confirming it against your installed version. Because the patched version is referenced via release notes rather than as an explicitly named CVE fix string, validate the exact fix build with Quest support before deployment. Until patched, restrict network reachability of the NVBUDashboard interface: place the management/JSON-RPC endpoint behind a VPN or firewall ACL so only trusted administrative hosts can reach it (trade-off: remote admins must use the VPN), and tighten or monitor dashboard authentication given the reported auth-bypass (trade-off: does not fully close the bypass, so treat it as detection rather than prevention). Run the NetVault service with the least privilege feasible and audit database query logs for anomalous JSON-RPC-sourced SQL. Consult the ZDI advisory ZDI-26-375 (https://www.zerodayinitiative.com/advisories/ZDI-26-375/) for additional detail.