CVE-2026-9782
Received Received - Intake
Quest NetVault Backup SQL Injection Remote Code Execution

Publication date: 2026-06-25

Last updated on: 2026-06-25

Assigner: Zero Day Initiative

Description
Quest NetVault Backup NVBUDeviceDrive SQL Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Quest NetVault Backup. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the processing of NVBUDeviceDrive JSON-RPC messages. The issue results from the lack of proper validation of a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to execute code in the context of NETWORK SERVICE. Was ZDI-CAN-27633.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-06-25
Last Modified
2026-06-25
Generated
2026-06-25
AI Q&A
2026-06-25
EPSS Evaluated
N/A
NVD
CVE-2026-9782
EUVD
EUVD-2026-39142
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
quest netvault_backup to 2026-06-24 (inc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-89 The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

CVE-2026-9782 is a critical SQL injection vulnerability found in Quest NetVault Backup. It occurs due to improper validation of user-supplied strings in the processing of NVBUDeviceDrive JSON-RPC messages, which are used to construct SQL queries.

Although authentication is normally required to exploit this vulnerability, the existing authentication mechanism can be bypassed by an attacker.

Exploiting this flaw allows remote attackers to execute arbitrary code with elevated privileges in the context of the NETWORK SERVICE account.

Impact Analysis

This vulnerability can have severe impacts including unauthorized remote code execution on affected systems.

An attacker who successfully exploits this flaw can run arbitrary code with NETWORK SERVICE privileges, potentially leading to full system compromise, data theft, or disruption of backup services.

Since the authentication mechanism can be bypassed, even users without valid credentials might exploit this vulnerability.

Mitigation Strategies

To mitigate this vulnerability, you should apply the update released by Quest that addresses the SQL injection flaw in the NVBUDeviceDrive JSON-RPC message processing.

Since the vulnerability allows bypassing authentication and remote code execution with elevated privileges, it is critical to update the affected Quest NetVault Backup installations as soon as possible.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-9782. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart