What is the CVSS score of EUVD-2026-39139?

EUVD-2026-39139 has a CVSS 3.0 base score of 8.8 (High). CVSS vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.7%.

Which versions of Quest NetVault Backup are affected by EUVD-2026-39139?

Quest NetVault Backup's NVBUDashboard component (CVE-2026-7570, CVSS 8.8) contains a critical authentication bypass allowing remote code execution as the NETWORK SERVICE account through SQL injection…

How to fix or mitigate EUVD-2026-39139?

Within 24 hours: Identify all Quest NetVault Backup instances running affected NVBUDashboard versions and isolate them from untrusted networks; review firewall logs for unauthorized JSON-RPC access attempts (default port 8080). Within 7 days: Implement firewall rules restricting NVBUDashboard access to authorized administrative networks only; enable comprehensive logging on NVBUDashboard authentication and SQL events; assess backup environment for lateral movement risk vectors. Within 30 days: Establish direct contact with Quest Software for patch timeline; evaluate alternative backup solutions or deployment architectures if Quest does not release patch; conduct security audit of backup infrastructure access controls.

Quest NetVault Backup EUVD-2026-39139

| CVE-2026-7570 HIGH

SQL Injection (CWE-89)

2026-06-25 zdi-disclosures@trendmicro.com

GHSA-fx4m-mp24-wx63

RCE SQLi Netvault Backup Quest

8.8

CVSS 3.0 · Vendor: trendmicro

Severity by source

Vendor (trendmicro) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network-reachable JSON-RPC SQLi with low complexity and no UI; PR:L reflects nominal auth, though the documented auth bypass arguably justifies PR:N, and SQLi-to-RCE yields full C/I/A.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (trendmicro).

CVSS VectorVendor: trendmicro

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 25, 2026 - 00:28 vuln.today

DescriptionCVE.org

Quest NetVault Backup NVBUDashboard SQL Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Quest NetVault Backup. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed.

The specific flaw exists within the processing of NVBUDashboard JSON-RPC messages. The issue results from the lack of proper validation of a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to execute code in the context of NETWORK SERVICE. Was ZDI-CAN-27809.

AnalysisAI

SQL injection leading to remote code execution in Quest NetVault Backup allows attackers to run arbitrary code as the NETWORK SERVICE account by sending crafted JSON-RPC messages to the NVBUDashboard component. While the JSON-RPC interface nominally requires authentication, ZDI reports the existing authentication mechanism can be bypassed, effectively lowering the access barrier. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV, but it was responsibly disclosed through Trend Micro's Zero Day Initiative (ZDI-26-368, formerly ZDI-CAN-27809).

Technical ContextAI

NetVault Backup is Quest's enterprise data-protection/backup platform; the affected NVBUDashboard subsystem exposes a JSON-RPC message-handling interface used for management and reporting. The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), where a user-supplied string from a JSON-RPC message is concatenated into a SQL query without proper validation or parameterization. Because the application service runs in the context of the Windows NETWORK SERVICE account, successful SQL injection is escalated into arbitrary code execution - typically by abusing database-layer functionality (e.g., stored procedures or command execution primitives) reachable from the injected query, turning a data-tier flaw into host-level compromise.

RemediationAI

Upgrade Quest NetVault Backup to the fixed release referenced in the vendor documentation - Quest NetVault Backup 14.0.2 (see release notes at https://support.quest.com/technical-documents/netvault/14.0.2/release-notes#TOPIC-2338529) - after confirming applicability against your installed version. Treat this as 'Patch available per vendor advisory': the references cite a Quest release-notes page rather than an explicit per-CVE fix line, so verify the exact patched build with Quest support before deploying. Until patched, restrict network access to the NetVault management/NVBUDashboard service by firewalling or segmenting it so only trusted administrative hosts can reach the JSON-RPC endpoint (trade-off: may disrupt remote management consoles and integrations); ensure the NetVault service account is not over-privileged and monitor the backing database and NETWORK SERVICE process for anomalous query patterns or child-process creation. Cross-check details against the ZDI advisory at https://www.zerodayinitiative.com/advisories/ZDI-26-368/.