What is the CVSS score of EUVD-2026-39141?

EUVD-2026-39141 has a CVSS 3.0 base score of 8.8 (High). CVSS vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.7%.

Which versions of Quest NetVault Backup are affected by EUVD-2026-39141?

Quest NetVault Backup contains a remote code execution vulnerability (CVE-2026-9781, CVSS 8.8) in its JSON-RPC message handler due to SQL injection, enabling attackers to execute arbitrary code…

How to fix or mitigate EUVD-2026-39141?

Within 24 hours: Identify and inventory all Quest NetVault Backup instances in production, document current versions, and contact Quest Software to confirm patch availability status. Within 7 days: Implement network segmentation to restrict JSON-RPC endpoint access to trusted administrators only via firewall rules; disable JSON-RPC message handler if operationally unnecessary; deploy SQL query and NETWORK SERVICE process execution monitoring. Within 30 days: If Quest releases a security patch, schedule deployment across all instances within change management windows; if no patch timeline is communicated, escalate to executive risk management and evaluate alternative backup solutions.

Quest NetVault Backup EUVD-2026-39141

| CVE-2026-9781 HIGH

SQL Injection (CWE-89)

2026-06-25 zdi-disclosures@trendmicro.com

GHSA-fv4p-f98h-cj9r

RCE SQLi Netvault Backup Quest

8.8

CVSS 3.0 · Vendor: trendmicro

Severity by source

Vendor (trendmicro) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network-facing JSON-RPC service with low-complexity SQLi yielding RCE as NETWORK SERVICE; PR:L reflects nominal auth, kept despite documented bypass, with full C/I/A impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (trendmicro).

CVSS VectorVendor: trendmicro

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 25, 2026 - 00:30 vuln.today

DescriptionCVE.org

Quest NetVault Backup NVBURASDevice SQL Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Quest NetVault Backup. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed.

The specific flaw exists within the processing of NVBURASDevice JSON-RPC messages. The issue results from the lack of proper validation of a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to execute code in the context of NETWORK SERVICE. Was ZDI-CAN-27648.

AnalysisAI

Remote code execution in Quest NetVault Backup arises from SQL injection in the NVBURASDevice JSON-RPC message handler, where attacker-controlled input is concatenated into SQL queries. Although authentication is nominally required, ZDI notes the existing authentication mechanism can be bypassed, so attackers can reach the vulnerable endpoint and execute code in the NETWORK SERVICE context. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV; it was reported privately via Trend Micro's Zero Day Initiative (ZDI-26-370 / ZDI-CAN-27648).

Technical ContextAI

NetVault Backup is an enterprise data-protection/backup product whose components communicate over JSON-RPC. The flaw lives in the NVBURASDevice service, which processes JSON-RPC messages and takes a user-supplied string and uses it to build a SQL query without proper validation or parameterization - a classic CWE-89 (SQL Injection). Because the underlying database engine and service privileges allow command execution paths, the injection is escalated from data tampering into full code execution running as the Windows NETWORK SERVICE account, indicating a Windows deployment of the backup server backend.

RemediationAI

Upgrade to the patched NetVault Backup release referenced in the Quest 14.0.2 release notes (https://support.quest.com/technical-documents/netvault/14.0.2/release-notes#TOPIC-2338529); treat 14.0.2 as the fixed version per the vendor reference, and cross-check the ZDI advisory (https://www.zerodayinitiative.com/advisories/ZDI-26-370/). The exact fix build is not independently restated in the input data, so verify the specific patched version in the release notes before deploying. Where immediate patching is not possible, restrict network access to the NetVault management/JSON-RPC service so that only trusted backup-administration hosts can reach it (network segmentation or host firewall rules on the NVBURASDevice listener), accepting that this can disrupt legitimate distributed backup clients or remote consoles that depend on that port; monitor the service for anomalous JSON-RPC requests as a detective control. Because authentication can be bypassed, do not rely on credential controls alone as a mitigation.