Quest NetVault Backup EUVD-2026-39144

Exploitation requires network reachability to the Quest NetVault Backup management service that processes NVBURemovableMedia JSON-RPC messages. Authentication is nominally required (CVSS PR:L), but ZDI explicitly states the existing authentication mechanism can be bypassed, which substantially weakens this prerequisite. The limiting factors are: the attacker must be able to reach the NetVault JSON-RPC service over the network (so it should not be internet-exposed), and must craft a request that exercises the NVBURemovableMedia code path; no user interaction is needed (UI:N) and attack complexity is low (AC:L). Code executes only with NETWORK SERVICE privileges, not SYSTEM/root, which bounds post-exploitation reach.

The CVSS 3.0 base score is 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H): network-reachable, low attack complexity, only low privileges required, no user interaction, with high confidentiality, integrity, and availability impact. The practical risk is amplified by ZDI's statement that the required authentication can be bypassed, which functionally narrows the gap between PR:L and PR:N. No EPSS score, KEV listing, or POC was provided in the input, so there is no current evidence of active exploitation or public exploit code - this appears to be a coordinated ZDI disclosure rather than an in-the-wild threat. The combination of network vector, low complexity, an authentication-bypass caveat, and code execution as a service account makes this a genuine high-priority patch candidate despite the absence of exploitation telemetry. EPSS data is missing; defenders should not treat the lack of an EPSS/KEV signal as low real-world risk given the authentication-bypass note.

An attacker with network access to the NetVault management service abuses the bypassable authentication mechanism to reach the NVBURemovableMedia JSON-RPC endpoint, then submits a crafted message containing a malicious string that is concatenated into a backend SQL query. The injected SQL is leveraged to achieve code execution as NETWORK SERVICE, giving the attacker control over the backup server and, by extension, the backup data it manages. No public POC was provided in the input.