CVE-2026-7569

Analyzed Analyzed - Analysis Complete

Quest NetVault Backup Cross-Site Scripting Authentication Bypass

Publication date: 2026-06-25

Last updated on: 2026-06-26

Assigner: Zero Day Initiative

Description

Quest NetVault Backup viewclient Cross-Site Scripting Authentication Bypass Vulnerability. This vulnerability allows remote attackers to bypass authentication on affected installations of Quest NetVault Backup. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the viewclient webpage. The issue results from the lack of proper validation of user-supplied data, which can lead to the injection of an arbitrary script. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-28202.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-06-25

Last Modified

2026-06-26

Generated

2026-07-15

AI Q&A

2026-06-25

EPSS Evaluated

2026-07-14

NVD

CVE-2026-7569

EUVD

EUVD-2026-39149

Affected Vendors & Products

Vendor	Product	Version / Range
quest	netvault_backup	to 14.0.2 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

CVE-2026-7569 is a vulnerability in Quest NetVault Backup's viewclient webpage that allows remote attackers to bypass authentication.

The flaw exists because the application does not properly validate user-supplied data, which enables attackers to inject arbitrary scripts.

Exploitation requires user interaction, such as the target visiting a malicious webpage or opening a malicious file.

Attackers can use this vulnerability in combination with others to execute arbitrary code with SYSTEM-level privileges.

Impact Analysis

This vulnerability can allow remote attackers to bypass authentication on affected Quest NetVault Backup installations.

By bypassing authentication, attackers may gain unauthorized access to the system.

Furthermore, attackers can leverage this vulnerability along with others to execute arbitrary code with SYSTEM privileges, potentially leading to full system compromise.

Mitigation Strategies

To mitigate the CVE-2026-7569 vulnerability in Quest NetVault Backup, you should apply the security update released by Quest that addresses this issue.

Additionally, since exploitation requires user interaction such as visiting a malicious page or opening a malicious file, educating users to avoid suspicious links and files can help reduce risk.

Compliance Impact

The vulnerability in Quest NetVault Backup allows remote attackers to bypass authentication and potentially execute arbitrary code with SYSTEM privileges. Such unauthorized access and potential data compromise could negatively impact compliance with standards and regulations like GDPR and HIPAA, which require strict controls on data access and protection of sensitive information.

However, the provided information does not explicitly discuss the direct impact of this vulnerability on compliance with these or other regulations.

Hi! I’m here to help you understand CVE-2026-7569. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70