CVE-2026-7570: Quest NetVault Backup SQL Injection RCE

CVE-2026-7570 Overview

CVE-2026-7570 is a SQL injection vulnerability in the NVBUDashboard component of Quest NetVault Backup. The flaw resides in the processing of JSON-RPC messages, where user-supplied input is concatenated into SQL queries without proper validation [CWE-89]. Remote attackers can leverage this issue to execute arbitrary code in the context of the NETWORK SERVICE account. While authentication is nominally required, the existing authentication mechanism can be bypassed, expanding the pool of potential attackers. The Zero Day Initiative tracked this issue as ZDI-CAN-27809 and published advisory ZDI-26-368.

Critical Impact
Remote attackers can bypass authentication and execute arbitrary code as NETWORK SERVICE on affected Quest NetVault Backup installations, exposing backup data and the broader network to compromise.

Affected Products

Quest NetVault Backup (versions prior to 14.0.2)
NVBUDashboard JSON-RPC interface
Deployments running under the NETWORK SERVICE account

Discovery Timeline

2026-06-25 - CVE-2026-7570 published to NVD
2026-06-25 - Last updated in NVD database

Technical Details for CVE-2026-7570

Vulnerability Analysis

The vulnerability exists in how the NVBUDashboard component processes incoming JSON-RPC messages. The backend takes a user-supplied string from the JSON-RPC payload and incorporates it directly into a SQL query string. Because the input is not parameterized or sanitized, an attacker can break out of the intended query context and append arbitrary SQL syntax.

Successful exploitation allows arbitrary code execution in the security context of NETWORK SERVICE. The flaw is reachable over the network with low attack complexity, and although authentication is required, the advisory states the authentication mechanism can be bypassed. This effectively lowers the barrier to exploitation to unauthenticated network access in many deployments.

The EPSS score for this issue is 0.709%, with a percentile of 48.778 as of 2026-06-25, indicating measurable but moderate near-term exploitation likelihood.

Root Cause

The root cause is improper neutralization of special elements used in an SQL command [CWE-89]. The NVBUDashboard handler builds SQL statements via string concatenation with attacker-controlled values from JSON-RPC messages. No prepared statements or input validation routines constrain the supplied data before query execution.

Attack Vector

The attack vector is network-based. An attacker sends a crafted JSON-RPC request to the NVBUDashboard endpoint containing malicious SQL syntax. After bypassing authentication, the attacker injects SQL constructs that the database engine executes, leading to arbitrary code execution under the NETWORK SERVICE account. Refer to the Zero Day Initiative Advisory ZDI-26-368 for additional technical context.

Detection Methods for CVE-2026-7570

Indicators of Compromise

Unexpected JSON-RPC requests to the NVBUDashboard endpoint containing SQL metacharacters such as single quotes, semicolons, or UNION keywords.
New child processes spawned by the NetVault Backup service running as NETWORK SERVICE.
Anomalous outbound network connections originating from the NetVault Backup host shortly after authentication events.

Detection Strategies

Inspect HTTP request bodies destined for the NetVault management interface for SQL injection patterns within JSON-RPC method parameters.
Correlate authentication events with subsequent process creation under the NetVault service account to surface post-exploitation activity.
Hunt for backup configuration changes, new accounts, or unexpected scheduled tasks introduced shortly after suspicious JSON-RPC activity.

Monitoring Recommendations

Enable verbose logging on the NetVault Backup management interface and forward logs to a centralized SIEM for retention and analysis.
Alert on any process tree where the NetVault service spawns shells, scripting engines, or LOLBins such as cmd.exe, powershell.exe, or certutil.exe.
Monitor database query logs for syntactically irregular statements originating from the NetVault application user.

How to Mitigate CVE-2026-7570

Immediate Actions Required

Upgrade Quest NetVault Backup to version 14.0.2 or later as documented in the Quest Release Notes 14.0.2.
Restrict network access to the NetVault management interface to trusted administrative networks only.
Audit existing NetVault accounts and rotate credentials for any administrative users.
Review logs for prior exploitation attempts against the NVBUDashboard endpoint.

Patch Information

Quest addressed this vulnerability in NetVault Backup 14.0.2. Administrators should apply the vendor-supplied update according to the Quest Release Notes 14.0.2. The Zero Day Initiative advisory ZDI-26-368 provides additional disclosure detail.

Workarounds

Place the NetVault management interface behind a VPN or jump host to limit network exposure.
Apply firewall rules that allow JSON-RPC traffic only from approved administrative IP addresses.
Where feasible, run the NetVault Backup service under a least-privileged account rather than NETWORK SERVICE to reduce post-exploitation impact.

bash

# Example: restrict NetVault management interface access at the host firewall (Windows)
netsh advfirewall firewall add rule name="NetVault Mgmt Allow Admins" \
  dir=in action=allow protocol=TCP localport=8443 \
  remoteip=10.0.10.0/24

netsh advfirewall firewall add rule name="NetVault Mgmt Deny Other" \
  dir=in action=block protocol=TCP localport=8443