CVE-2026-9780: Quest NetVault Backup Auth Bypass Flaw

CVE-2026-9780 Overview

CVE-2026-9780 is a Cross-Site Scripting (XSS) vulnerability in the addclient3 webpage of Quest NetVault Backup. The flaw allows remote attackers to bypass authentication on affected installations. Exploitation requires user interaction: the target must visit a malicious page or open a malicious file. The vulnerability stems from improper validation of user-supplied data, enabling injection of arbitrary script content. Attackers can chain this issue with other vulnerabilities to execute arbitrary code in the context of SYSTEM. The issue was reported through the Zero Day Initiative as ZDI-CAN-27666 and disclosed in advisory ZDI-26-369.

Critical Impact
An attacker can bypass authentication and, when combined with other flaws, execute arbitrary code with SYSTEM privileges on the NetVault Backup host.

Affected Products

Quest NetVault Backup (versions prior to 14.0.2)
NetVault Backup web management interface (addclient3 component)
Windows deployments where the NetVault service runs as SYSTEM

Discovery Timeline

2026-06-25 - CVE-2026-9780 published to NVD
2026-06-25 - Last updated in NVD database

Technical Details for CVE-2026-9780

Vulnerability Analysis

The vulnerability resides in the addclient3 webpage of the Quest NetVault Backup management interface. The application fails to properly validate or sanitize user-supplied input before reflecting it into the rendered page. This allows an attacker to inject arbitrary JavaScript that executes in the browser session of a user who visits a crafted URL or opens a malicious file.

Because the injected script runs in the authenticated context of the NetVault web application, the attacker bypasses authentication controls on the management interface. The Zero Day Initiative classifies this issue as an authentication bypass because the script can perform privileged actions without the attacker possessing valid credentials. Chaining the XSS with additional command or code execution flaws in NetVault Backup permits arbitrary code execution in the context of SYSTEM on Windows hosts.

Root Cause

The root cause is improper neutralization of input during web page generation [CWE-79]. The addclient3 endpoint accepts client-supplied parameters and embeds them into HTML output without contextual encoding or input filtering. Any character sequence that closes the current HTML context, such as <script> tags or event handler attributes, is rendered as executable markup.

Attack Vector

The attack vector is network-based and requires user interaction. An attacker crafts a malicious URL targeting the addclient3 page with an embedded XSS payload. The attacker then delivers the link through phishing, a malicious web page, or an attached file. When an administrator with an active NetVault session visits the link, the injected script executes in their browser. The script can issue authenticated requests to the NetVault backend, modify configuration, add backup clients, or stage follow-on payloads that exercise other vulnerabilities to reach SYSTEM code execution.

No verified public exploit code is available. See the Zero Day Initiative Advisory ZDI-26-369 for additional technical details.

Detection Methods for CVE-2026-9780

Indicators of Compromise

HTTP requests to the addclient3 endpoint containing script tags, javascript: URIs, or HTML event handler attributes such as onerror= and onload=.
Unexpected creation of new backup clients or modification of NetVault configuration outside of change windows.
Outbound HTTP callbacks from administrator browsers to unknown domains shortly after accessing the NetVault console.
Child processes spawned by NetVault service binaries that do not match normal backup operations.

Detection Strategies

Inspect web server and application logs for requests to addclient3 containing URL-encoded <, >, or script tokens.
Apply web application firewall rules that flag reflected XSS patterns targeting the NetVault management interface.
Correlate administrator authentication events with subsequent privileged configuration changes to identify session-riding behavior.

Monitoring Recommendations

Forward NetVault Backup access logs and Windows event logs to a centralized analytics platform for retention and correlation.
Alert on process creation events where NetVault service processes spawn cmd.exe, powershell.exe, or scripting interpreters.
Monitor for unexpected outbound network connections from hosts running the NetVault management server.

How to Mitigate CVE-2026-9780

Immediate Actions Required

Upgrade Quest NetVault Backup to version 14.0.2 or later as documented in the vendor release notes.
Restrict network access to the NetVault Backup management interface so that only trusted administrative networks can reach it.
Require administrators to log out of the NetVault console when not actively performing management tasks to reduce session-riding exposure.
Train administrators to avoid clicking links or opening files that reference NetVault management URLs from untrusted sources.

Patch Information

Quest has addressed CVE-2026-9780 in NetVault Backup 14.0.2. Review the Quest Release Notes 14.0.2 for upgrade guidance and complete fix details. Administrators should validate the deployed version after upgrade and confirm that the management web interface presents the patched build.

Workarounds

Place the NetVault Backup management interface behind a reverse proxy or VPN that enforces source IP allow-listing.
Configure browser isolation or a dedicated administrative workstation for accessing the NetVault console to prevent cross-site script delivery from general browsing.
Enforce strict Content Security Policy headers at any fronting proxy to reduce the impact of reflected script injection until the patch is applied.

bash

# Configuration example: restrict access to the NetVault management interface
# Example Windows Firewall rule allowing only an admin subnet to reach TCP/8443
netsh advfirewall firewall add rule name="NetVault Admin Only" \
  dir=in action=allow protocol=TCP localport=8443 \
  remoteip=10.10.50.0/24