What is the CVSS score of CVE-2026-9787?

CVE-2026-9787 has a CVSS 3.0 base score of 8.8 (High). CVSS vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 1.4%.

Which versions of Quest NetVault Backup are affected by CVE-2026-9787?

Quest NetVault Backup contains a remote code execution vulnerability (CVSS 8.8) in the NVBULogDaemon JSON-RPC interface that allows attackers to execute arbitrary commands as SYSTEM after…

How to fix or mitigate CVE-2026-9787?

Within 24 hours: Identify all NetVault Backup instances and restrict network access to the NVBULogDaemon interface (limit to trusted administrative networks). Within 7 days: Disable JSON-RPC functionality if operationally feasible; if required, implement multi-factor authentication and audit all access logs for anomalous activity. Within 30 days: Monitor Quest/ZDI advisories for patch availability and prepare upgrade testing when released; document current network segmentation as a temporary compensating control.

Quest NetVault Backup CVE-2026-9787

EUVD-2026-39148 HIGH

OS Command Injection (CWE-78)

2026-06-25 zdi-disclosures@trendmicro.com

GHSA-g493-6gcx-x935

RCE Command Injection Netvault Backup Quest

8.8

CVSS 3.0 · Vendor: trendmicro

Severity by source

Vendor (trendmicro) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network-reachable JSON-RPC daemon with low-complexity command injection; PR:L reflects the stated credential requirement, though the documented auth bypass could justify PR:N, with full SYSTEM-level C/I/A impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (trendmicro).

CVSS VectorVendor: trendmicro

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 25, 2026 - 00:33 vuln.today

DescriptionCVE.org

Quest NetVault Backup NVBULogDaemon Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Quest NetVault Backup. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed.

The specific flaw exists within the processing of NVBULogDaemon JSON-RPC messages. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. Was ZDI-CAN-27625.

AnalysisAI

Remote code execution in Quest NetVault Backup allows authenticated remote attackers - who can bypass the product's existing authentication mechanism - to run arbitrary OS commands as SYSTEM via the NVBULogDaemon JSON-RPC interface. The flaw stems from unsanitized user-supplied input being passed into a system call (CWE-78), and the credentialed authentication barrier is undermined by an acknowledged bypass, effectively widening exposure. No public exploit has been identified at time of analysis, but the issue was disclosed by Trend Micro ZDI (ZDI-26-376) and carries a CVSS of 8.8.

Technical ContextAI

Quest NetVault Backup is an enterprise data-protection/backup platform that centrally manages backup and recovery jobs across heterogeneous server environments. The vulnerable component, NVBULogDaemon, exposes a JSON-RPC message interface; the root cause is CWE-78 (Improper Neutralization of Special Elements used in an OS Command), where a user-controlled string from a JSON-RPC message is concatenated into a system/shell call without proper validation or escaping. Because the daemon runs with SYSTEM privileges, any injected command inherits full local system authority. No CPE strings were supplied in the input, so exact affected build identifiers are not enumerated here beyond the vendor product line.

RemediationAI

Upgrade Quest NetVault Backup to the fixed release indicated in the vendor's NetVault 14.0.2 release notes (https://support.quest.com/technical-documents/netvault/14.0.2/release-notes#TOPIC-2338529); the referenced release notes point to 14.0.2 as the relevant patched line, but confirm the exact fixed build with Quest support before deploying. As compensating controls until patched, restrict network access to the NVBULogDaemon JSON-RPC service to trusted management hosts only (firewall/segment the backup management port so it is not broadly reachable), which limits the network attack vector at the cost of breaking any remote agents that legitimately need that port. Because authentication can be bypassed, do not rely solely on credentials - also rotate/limit NetVault accounts and monitor the daemon for anomalous command execution. Refer to ZDI-26-376 (https://www.zerodayinitiative.com/advisories/ZDI-26-376/) for advisory details.