Quest NetVault Backup EUVD-2026-39139

Exploitation requires network access to the NetVault Backup NVBUDashboard JSON-RPC interface and the ability to submit messages to it. The CVSS vector lists PR:L (authenticated), but the description explicitly states the existing authentication mechanism can be bypassed, so valid credentials are not a hard prerequisite - the practical limiting factor is reachability of the NVBUDashboard endpoint rather than authentication. No user interaction is required (UI:N) and attack complexity is low (AC:L). Realistic risk is bounded mainly by whether the management interface is network-exposed versus segmented to trusted administrative hosts, and by the installed version being prior to the 14.0.2 fix.

The CVSS 3.0 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 8.8) signals a network-reachable, low-complexity attack requiring only low privileges and no user interaction, with full confidentiality, integrity, and availability impact - a serious combination for a backup server that holds privileged access to an organization's data. The stated requirement for authentication (PR:L) is materially weakened by ZDI's note that the authentication mechanism can be bypassed, so the effective barrier to exploitation may be closer to unauthenticated than the vector implies - defenders should treat PR:L cautiously. No EPSS score, KEV entry, SSVC decision, or public POC was provided in the input, so probabilistic exploitation likelihood is unquantified here; the absence of these is a data gap, not evidence of low risk. Given a high-value target class (backup infrastructure), RCE outcome, and a credible ZDI advisory, this should be prioritized for patching despite the lack of confirmed in-the-wild activity.

An attacker who can reach the NetVault Backup management interface - leveraging the documented authentication bypass, or using low-privilege credentials - sends a crafted NVBUDashboard JSON-RPC message containing a malicious SQL fragment. The injection executes against the backend database and is used to run operating-system commands, giving the attacker code execution as NETWORK SERVICE on the backup server. No public POC is identified at time of analysis, but the low attack complexity makes reliable exploitation plausible once the request format is known.