Quest NetVault Backup CVE-2026-9787

Exploitation requires network access to the NVBULogDaemon JSON-RPC message interface on a Quest NetVault Backup installation. The CVSS vector lists PR:L (authenticated), but the description explicitly states the existing authentication mechanism can be bypassed, so the practical authentication requirement is substantially weakened. No user interaction is needed (UI:N) and attack complexity is low (AC:L). Limiting factors: the attacker must be able to reach the JSON-RPC service over the network and must successfully invoke the authentication bypass; if the management port is firewalled to trusted hosts, exposure is significantly reduced. Successful exploitation yields code execution in the SYSTEM context.

The CVSS 3.0 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 8.8) indicates network-reachable, low-complexity exploitation requiring only low privileges and no user interaction, with full confidentiality, integrity, and availability impact - a serious profile for a backup server that typically holds privileged access to many systems. The stated authentication bypass effectively erodes the PR:L barrier, pushing real-world risk closer to unauthenticated RCE and warranting urgent prioritization. No EPSS score, KEV listing, or SSVC decision data was provided, and no public exploit is identified, so the immediate mass-exploitation probability is unquantified; however, ZDI-sourced RCE flaws in backup infrastructure are attractive ransomware targets. The combination of SYSTEM-level impact and an auth bypass means this should be treated as a high priority despite the absence of EPSS/KEV signals - those are missing data, not evidence of low risk.

An attacker with network reach to the NetVault management interface leverages the documented authentication bypass to gain access, then sends a crafted NVBULogDaemon JSON-RPC message embedding shell metacharacters in a string that the daemon passes to a system call. Given low attack complexity and no required user interaction, the injected command executes as SYSTEM, granting full control of the backup server and a pivot point into the protected backup estate. No public proof-of-concept is identified at this time.