CVE-2026-9784
Received Received - Intake
SQL Injection in Quest NetVault Backup

Publication date: 2026-06-25

Last updated on: 2026-06-25

Assigner: Zero Day Initiative

Description
Quest NetVault Backup NVBULibraryPort SQL Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Quest NetVault Backup. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the processing of NVBULibraryPort JSON-RPC messages. The issue results from the lack of proper validation of a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to execute code in the context of NETWORK SERVICE. Was ZDI-CAN-27631.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-06-25
Last Modified
2026-06-25
Generated
2026-06-25
AI Q&A
2026-06-25
EPSS Evaluated
N/A
NVD
CVE-2026-9784
EUVD
EUVD-2026-39145
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
quest netvault_backup to 2026-06-24 (inc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-89 The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Compliance Impact

The provided information does not specify how this vulnerability affects compliance with common standards and regulations such as GDPR or HIPAA.

Mitigation Strategies

To mitigate this vulnerability, you should apply the update released by Quest that addresses the issue.

Since the vulnerability allows remote code execution via SQL injection in NVBULibraryPort JSON-RPC messages and authentication can be bypassed, it is critical to update the affected software as soon as possible.

Executive Summary

CVE-2026-9784 is a critical vulnerability in Quest NetVault Backup that allows remote attackers to execute arbitrary code on affected systems.

The flaw exists due to improper validation of user-supplied strings in NVBULibraryPort JSON-RPC messages, enabling SQL injection attacks.

Although authentication is required, the existing authentication mechanism can be bypassed, allowing attackers to exploit the vulnerability.

Successful exploitation grants attackers code execution privileges in the context of NETWORK SERVICE.

Impact Analysis

This vulnerability can have severe impacts as it allows remote attackers to execute arbitrary code on affected installations of Quest NetVault Backup.

Attackers can bypass authentication and gain code execution privileges in the context of NETWORK SERVICE, potentially leading to full system compromise.

The high CVSS score of 8.8 reflects the critical nature of this vulnerability, indicating high confidentiality, integrity, and availability impacts.

Detection Guidance

This vulnerability involves SQL injection via NVBULibraryPort JSON-RPC messages in Quest NetVault Backup. Detection would typically involve monitoring for unusual or malformed JSON-RPC requests targeting the NVBULibraryPort service, especially those attempting to inject SQL commands.

Since the vulnerability allows bypassing authentication, network traffic analysis tools could be used to inspect incoming requests to the NetVault Backup server on the relevant ports for suspicious payloads.

Specific commands are not provided in the available resources. However, general approaches might include using network packet capture tools like tcpdump or Wireshark to filter traffic to the NetVault Backup server, for example:

  • tcpdump -i <interface> -A port <NVBULibraryPort_port>
  • grep or jq can be used to analyze JSON-RPC messages for suspicious SQL injection patterns.

Additionally, reviewing server logs for unexpected or malformed JSON-RPC requests could help detect exploitation attempts.

For precise detection commands or signatures, users should refer to vendor advisories or security tools updated to detect CVE-2026-9784.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-9784. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart