EUVD-2026-39147
GHSA-qhv7-8f66-468j
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach NVBUDashboard JSON-RPC endpoint
-
DeliveryBypass authentication mechanism
-
ExploitSubmit crafted JSON-RPC message
-
ExecutionInject malicious SQL string
-
PersistEscalate injection to code execution
-
ImpactRun code as NETWORK SERVICE
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Parameterized queries, prepared statements
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network access to the NetVault Backup NVBUDashboard interface and the ability to submit JSON-RPC messages to it. Nominally an authenticated session is needed (CVSS PR:L), but ZDI states the existing authentication mechanism can be bypassed, so the authentication requirement is not a reliable barrier. The concrete trigger is a user-supplied string in an NVBUDashboard JSON-RPC message that is passed unvalidated into a SQL query (CWE-89). Limiting factors: the attacker must be able to route to the dashboard/JSON-RPC service (so network-segmented or VPN-gated deployments reduce exposure), and code execution lands in the NETWORK SERVICE context rather than SYSTEM/Administrator, bounding initial privilege; no user interaction is required (UI:N). |
| Impact | The CVSS 3.0 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H = 8.8) describes a network-reachable, low-complexity attack needing only low privileges and no user interaction, with full confidentiality, integrity and availability impact - a strong signal on its own. The risk is amplified by ZDI's note that the required authentication can be bypassed, which in practice pushes the effective privilege requirement toward PR:N. Tempering this: no EPSS score was provided, the CVE is not in CISA KEV (so no confirmed active exploitation), and no public proof-of-concept is referenced, indicating no public exploit identified at time of analysis. The signals are consistent rather than conflicting - a high-severity, easily-exploitable flaw that is not yet known to be exploited in the wild - so it warrants prompt patching, especially for internet- or network-exposed dashboards, but is not (yet) an emergency on the level of a KEV-listed bug. |
| Exploit ScenarioDerived | An attacker who can reach the NVBUDashboard endpoint - leveraging the reported ability to bypass authentication - sends a crafted JSON-RPC message containing a malicious string that is injected into a backend SQL query. The injection is escalated to operating-system code execution running as NETWORK SERVICE, giving the attacker a foothold on the backup server. No public proof-of-concept is referenced, but the low attack complexity makes reliable exploitation plausible once the request format is known. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 25, 2026
Remote code execution in Quest NetVault Backup arises through SQL injection in the NVBUDashboard component's JSON-RPC message handler, letting attackers run arbitrary code in the NETWORK SERVICE context. While the flaw nominally requires authentication, ZDI reports the product's authentication mechanism can be bypassed, materially lowering the access bar. No public exploit is identified at time of analysis and the issue is not listed in CISA KEV, but its CVSS 3.0 base score of 8.8 and full-impact (C:H/I:H/A:H) profile mark it as high priority for any exposed deployment.
RemediationAI
Upgrade NetVault Backup to the fixed release indicated in the vendor release notes - the references point to NetVault 14.0.2 (https://support.quest.com/technical-documents/netvault/14.0.2/release-notes#TOPIC-2338529), so apply that build or later after confirming it against your installed version. Because the patched version is referenced via release notes rather than as an explicitly named CVE fix string, validate the exact fix build with Quest support before deployment. Until patched, restrict network reachability of the NVBUDashboard interface: place the management/JSON-RPC endpoint behind a VPN or firewall ACL so only trusted administrative hosts can reach it (trade-off: remote admins must use the VPN), and tighten or monitor dashboard authentication given the reported auth-bypass (trade-off: does not fully close the bypass, so treat it as detection rather than prevention). Run the NetVault service with the least privilege feasible and audit database query logs for anomalous JSON-RPC-sourced SQL. Consult the ZDI advisory ZDI-26-375 (https://www.zerodayinitiative.com/advisories/ZDI-26-375/) for additional detail.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
NetVault Backup is Quest's cross-platform enterprise data-protection and backup management suite; the affected NVBUDashboard is its web-facing dashboard/management interface, which exchanges JSON-RPC messages with the backend. The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command): a user-supplied string carried inside a JSON-RPC request is concatenated into a SQL query without proper validation or parameterization. Because the underlying database service and the NetVault process run with NETWORK SERVICE privileges on Windows, SQL injection escalates from data tampering into command/code execution - typical of database stacked-query or extended-procedure abuse where the injection point yields OS-level execution rather than just data disclosure.
Know when Netvault Backup gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Network-reachable JSON-RPC SQLi with low complexity and no user interaction; PR:L for the nominal auth requirement (reported bypass arguably warrants PR:N), full C/I/A impact via code execution.
Primary rating from Vendor (trendmicro).
CVSS VectorVendor: trendmicro
DescriptionCVE.org
Quest NetVault Backup NVBUDashboard SQL Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Quest NetVault Backup. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed.
The specific flaw exists within the processing of NVBUDashboard JSON-RPC messages. The issue results from the lack of proper validation of a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to execute code in the context of NETWORK SERVICE. Was ZDI-CAN-27626.
Executive ViewAI
Quest NetVault Backup deployments are vulnerable to remote code execution through a SQL injection flaw in the JSON-RPC interface, with a reported authentication bypass lowering the attack barrier for anyone with network access. Compromise of backup infrastructure represents a critical threat to business continuity, as attackers gaining code execution could access, encrypt, or destroy the backup data that organizations rely on to recover from ransomware and destructive cyberattacks. This risk is elevated by the absence of a vendor patch and the central role backup systems play in disaster recovery.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Restrict network access to NetVault Backup administrative interfaces to authorized IP addresses only; (2) Deploy Web Application Firewall rules to block JSON-RPC requests from untrusted sources if applicable; (3) Disable unnecessary NVBUDashboard services if operationally feasible; (4) Enable comprehensive audit logging of all database and backup system activities; (5) Implement network-based monitoring for SQL injection attack patterns; (6) Maintain offline backup copies independent from primary backup infrastructure to ensure recovery capability even if backup system is compromised.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Related Vulnerabilities in Quest NetVault Backup Injection and XSS Vulnerabilities
View all 10More in Netvault Backup
View allDell Netvault Backup before 10.0.5 allows remote attackers to cause a denial of service (crash) via a crafted request. R
Integer overflow in the libnv6 module in Dell NetVault Backup before 10.0.5 allows remote attackers to execute arbitrary
This vulnerability allows remote attackers to bypass authentication on vulnerable installations of Quest NetVault Backup
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Quest NetVault Backu
Exploit-DB