CVE-2026-9781: Quest NetVault Backup RCE Vulnerability

CVE-2026-9781 Overview

CVE-2026-9781 is a SQL injection vulnerability in Quest NetVault Backup that leads to remote code execution. The flaw resides in the processing of NVBURASDevice JSON-RPC messages, where user-supplied input is concatenated into SQL queries without proper validation [CWE-89]. While authentication is nominally required, the existing authentication mechanism can be bypassed, lowering the barrier to exploitation. Successful exploitation allows attackers to execute arbitrary code in the context of the NETWORK SERVICE account on the backup server. The issue was reported through the Zero Day Initiative as ZDI-CAN-27648 and disclosed in advisory ZDI-26-370.

Critical Impact
Remote attackers can execute arbitrary code as NETWORK SERVICE on Quest NetVault Backup installations, with the documented authentication requirement bypassable.

Affected Products

Quest NetVault Backup (versions prior to 14.0.2)
Quest NetVault Backup server components processing NVBURASDevice JSON-RPC messages
Installations exposing the NetVault management service to untrusted networks

Discovery Timeline

2026-06-25 - CVE-2026-9781 published to the National Vulnerability Database
2026-06-25 - Zero Day Initiative publishes advisory ZDI-26-370
2026-06-25 - Last updated in NVD database

Technical Details for CVE-2026-9781

Vulnerability Analysis

The vulnerability exists in the NVBURASDevice JSON-RPC message handler within Quest NetVault Backup. The service accepts JSON-RPC requests containing string parameters that are subsequently used to construct SQL statements. Because the handler does not parameterize queries or sanitize input, an attacker can inject arbitrary SQL syntax into the backend database query.

Exploitation produces more than data exposure. The injected SQL chain results in arbitrary code execution in the context of the NETWORK SERVICE account, which has sufficient privileges on the host to manipulate backup operations and pivot further into the environment. Backup infrastructure typically holds credentials and connectivity to high-value systems, making this a high-value target for ransomware and data theft operations.

Root Cause

The root cause is improper neutralization of special elements used in SQL commands [CWE-89]. User-controlled strings extracted from JSON-RPC payloads are concatenated directly into SQL queries instead of being bound as parameters. A secondary weakness — bypassable authentication on the JSON-RPC endpoint — removes the intended access control on the injection point.

Attack Vector

The attack vector is network-based with low complexity. An attacker reaches the NVBURASDevice endpoint over the network, defeats the authentication check, and submits a crafted JSON-RPC message containing SQL metacharacters in a string parameter. The malicious query executes against the backend database and chains into code execution under NETWORK SERVICE. No user interaction is required.

Technical details are documented in the Zero Day Initiative Advisory ZDI-26-370.

Detection Methods for CVE-2026-9781

Indicators of Compromise

Unexpected JSON-RPC requests to NetVault Backup endpoints containing SQL metacharacters such as single quotes, UNION, --, or stacked statements in NVBURASDevice parameters
New child processes spawned by the NetVault service running as NETWORK SERVICE, particularly cmd.exe, powershell.exe, or script interpreters
Outbound network connections originating from the NetVault Backup host to unfamiliar external addresses
Anomalous writes to the NetVault database followed by service restarts or job manipulation

Detection Strategies

Inspect application and web server logs for JSON-RPC payloads referencing NVBURASDevice with SQL syntax in string fields
Alert on process lineage where the NetVault Backup service spawns shell, scripting, or LOLBin processes
Correlate failed authentication events on NetVault endpoints with subsequent successful JSON-RPC activity to identify auth-bypass attempts

Monitoring Recommendations

Forward NetVault Backup application logs and Windows Security/Sysmon events to a centralized analytics platform for correlation
Baseline normal JSON-RPC traffic volume and method usage, then alert on deviations targeting NVBURASDevice
Monitor backup infrastructure for unauthorized configuration changes, new administrative accounts, or modifications to backup retention policies

How to Mitigate CVE-2026-9781

Immediate Actions Required

Upgrade Quest NetVault Backup to version 14.0.2 or later, which addresses this vulnerability per the vendor release notes
Restrict network access to the NetVault Backup management service to trusted administrative networks only
Audit accounts and credentials used by the NetVault service and rotate any that may have been exposed
Review backup jobs, schedules, and stored credentials for unauthorized modifications

Patch Information

Quest has addressed this vulnerability in NetVault Backup 14.0.2. Refer to the Quest Release Notes 14.0.2 for upgrade instructions and fixed-version details. The Zero Day Initiative Advisory ZDI-26-370 provides additional context on the disclosure.

Workarounds

Place the NetVault Backup server behind a firewall or VPN that limits access to administrative subnets and known operator hosts
Disable or block external exposure of the JSON-RPC interface where business operations permit
Apply host-based segmentation so the backup server cannot initiate outbound connections to the internet

bash

# Example: restrict access to the NetVault management port to a trusted subnet (Windows firewall)
netsh advfirewall firewall add rule name="NetVault-Mgmt-Restrict" ^
    dir=in action=allow protocol=TCP localport=8443 ^
    remoteip=10.0.10.0/24
netsh advfirewall firewall add rule name="NetVault-Mgmt-Deny" ^
    dir=in action=block protocol=TCP localport=8443