What is the CVSS score of EUVD-2026-39146?

EUVD-2026-39146 has a CVSS 3.0 base score of 8.8 (High). CVSS vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.7%.

Which versions of Quest NetVault Backup are affected by EUVD-2026-39146?

Quest NetVault Backup contains a critical remote code execution vulnerability (CVE-2026-9785) in its JSON-RPC interface where an authentication bypass enables SQL injection and arbitrary code…

How to fix or mitigate EUVD-2026-39146?

Within 24 hours: inventory all NetVault Backup systems and assess network exposure to untrusted segments. Within 7 days: restrict JSON-RPC interface access via firewall rules, disable remote access if not required for operations, and enable comprehensive logging. Within 30 days: monitor Quest security advisories for patch availability and establish upgrade timeline.

Quest NetVault Backup EUVD-2026-39146

| CVE-2026-9785 HIGH

SQL Injection (CWE-89)

2026-06-25 zdi-disclosures@trendmicro.com

GHSA-qc3q-wgvh-ww57

RCE SQLi Netvault Backup Quest

8.8

CVSS 3.0 · Vendor: trendmicro

Severity by source

Vendor (trendmicro) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Network-reachable JSON-RPC with low complexity plus a documented authentication bypass justifies PR:N; SQLi-to-RCE as NETWORK SERVICE yields C:H/I:H/A:H, scope unchanged.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (trendmicro).

CVSS VectorVendor: trendmicro

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 25, 2026 - 00:32 vuln.today

DescriptionCVE.org

Quest NetVault Backup NVBULibrarySlot SQL Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Quest NetVault Backup. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed.

The specific flaw exists within the processing of NVBULibrarySlot JSON-RPC messages. The issue results from the lack of proper validation of a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to execute code in the context of NETWORK SERVICE. Was ZDI-CAN-27630.

AnalysisAI

Remote code execution in Quest NetVault Backup arises from a SQL injection flaw in the handling of NVBULibrarySlot JSON-RPC messages, where a user-supplied string is concatenated into a SQL query without validation. Although the JSON-RPC interface nominally requires authentication, ZDI notes the existing authentication mechanism can be bypassed, so a remote attacker can reach the vulnerable code path and execute arbitrary code in the context of the NETWORK SERVICE account. No public exploit has been identified at time of analysis and the issue is not listed in CISA KEV; EPSS data was not provided.

Technical ContextAI

NetVault Backup is Quest's enterprise data-protection/backup platform whose management service exposes a JSON-RPC API. The vulnerable handler, NVBULibrarySlot, processes JSON-RPC messages and constructs SQL queries by directly embedding attacker-controlled string data - the classic CWE-89 (Improper Neutralization of Special Elements used in an SQL Command) root cause. Because the backend database is reachable from the injected query, the SQLi is escalated from data manipulation into full remote code execution running as NETWORK SERVICE, a built-in Windows service account. No CPE strings were supplied in the input, so exact affected build identifiers must be derived from vendor release notes rather than NVD CPE matching.

RemediationAI

Upgrade Quest NetVault Backup to the patched release referenced in the vendor's 14.0.2 release notes (https://support.quest.com/technical-documents/netvault/14.0.2/release-notes#TOPIC-2338529); treat this as the primary fix and confirm the exact build against Quest's advisory before deploying, since a single patched version string was not enumerated in the input. Until patched, restrict network reachability of the NetVault management/JSON-RPC service by placing it behind a firewall or a dedicated management VLAN and blocking access from untrusted networks - this limits exposure but does not remove the flaw for any host that can still reach the service. Because the authentication mechanism itself can be bypassed, do not rely on credential hardening or password rotation alone as a mitigation; network-level access control plus prompt patching are the dependable controls. Cross-reference ZDI-26-374 (https://www.zerodayinitiative.com/advisories/ZDI-26-374/) for advisory details.