CVE-2026-9783
Analyzed Analyzed - Analysis Complete

SQL Injection in Quest NetVault Backup

Publication date: 2026-06-25

Last updated on: 2026-06-26

Assigner: Zero Day Initiative

Description
Quest NetVault Backup NVBURemovableMedia SQL Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Quest NetVault Backup. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the processing of NVBURemovableMedia JSON-RPC messages. The issue results from the lack of proper validation of a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to execute code in the context of NETWORK SERVICE. Was ZDI-CAN-27632.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-06-25
Last Modified
2026-06-26
Generated
2026-07-15
AI Q&A
2026-06-25
EPSS Evaluated
2026-07-14
NVD
CVE-2026-9783
EUVD
EUVD-2026-39144

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
quest netvault_backup to 14.0.2 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-89 The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Compliance Impact

The provided information does not specify how the CVE-2026-9783 vulnerability affects compliance with common standards and regulations such as GDPR or HIPAA.

Executive Summary

CVE-2026-9783 is a vulnerability in Quest NetVault Backup that allows remote attackers to execute arbitrary code. The flaw is due to improper validation of user-supplied strings used in SQL queries within the NVBURemovableMedia JSON-RPC message processing. Although authentication is required to exploit this vulnerability, the authentication mechanism can be bypassed, enabling attackers to run code with NETWORK SERVICE privileges.

Impact Analysis

This vulnerability can have a severe impact as it allows remote attackers to execute arbitrary code on affected systems. Successful exploitation could lead to full compromise of the Quest NetVault Backup installation, potentially allowing attackers to manipulate backup data, disrupt backup operations, or use the compromised system as a foothold for further attacks within the network.

Mitigation Strategies

To mitigate this vulnerability, you should apply the update released by Quest for NetVault Backup that addresses the issue with NVBURemovableMedia JSON-RPC message processing.

Since the vulnerability allows remote code execution by bypassing authentication, it is critical to update the affected software as soon as possible to prevent exploitation.

Detection Guidance

This vulnerability exists in the processing of NVBURemovableMedia JSON-RPC messages in Quest NetVault Backup. Detection would involve monitoring or inspecting JSON-RPC traffic related to NVBURemovableMedia for suspicious or malformed requests that attempt to exploit SQL injection.

Since the vulnerability involves SQL injection via user-supplied strings in JSON-RPC messages, one approach is to capture and analyze network traffic to identify unusual or unexpected JSON-RPC calls targeting NVBURemovableMedia endpoints.

Specific commands are not provided in the available resources, but general detection methods could include using network traffic analysis tools like tcpdump or Wireshark to filter for JSON-RPC messages to the NetVault Backup server, for example:

  • tcpdump -i <interface> -A -s 0 'tcp port <NetVault_port>' | grep NVBURemovableMedia
  • Using application logs from NetVault Backup to identify suspicious authentication bypass attempts or unusual JSON-RPC requests.

Additionally, since the vulnerability requires authentication which can be bypassed, monitoring for unexpected or unauthorized JSON-RPC activity is important.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-9783. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart