CVE-2026-9784 Overview
CVE-2026-9784 is a SQL injection vulnerability in Quest NetVault Backup that allows remote attackers to execute arbitrary code on affected installations. The flaw resides in the processing of NVBULibraryPort JSON-RPC messages, where user-supplied input is concatenated into SQL queries without proper validation [CWE-89]. While authentication is required, the existing authentication mechanism can be bypassed, lowering the bar for exploitation. Successful exploitation grants code execution in the context of the NETWORK SERVICE account. The Zero Day Initiative tracked this issue as ZDI-CAN-27631 and published advisory ZDI-26-373.
Critical Impact
Remote attackers can bypass authentication and inject SQL commands through NVBULibraryPort JSON-RPC messages to execute arbitrary code as NETWORK SERVICE on Quest NetVault Backup servers.
Affected Products
- Quest NetVault Backup (versions prior to 14.0.2)
- Quest NetVault Backup server component handling NVBULibraryPort JSON-RPC messages
- Deployments exposing the NetVault management service to untrusted networks
Discovery Timeline
- 2026-06-25 - CVE-2026-9784 published to the National Vulnerability Database
- 2026-06-25 - Zero Day Initiative publishes advisory ZDI-26-373
- 2026-06-25 - Last updated in NVD database
Technical Details for CVE-2026-9784
Vulnerability Analysis
The vulnerability exists in the NVBULibraryPort component of Quest NetVault Backup. The component exposes a JSON-RPC interface that accepts client-supplied parameters and uses them when constructing back-end SQL queries. Because the service does not properly validate or parameterize the supplied strings, an attacker can inject SQL syntax into the query. The injected SQL is executed by the database engine running under the NETWORK SERVICE account on the NetVault host. Although the JSON-RPC endpoint requires authentication, the advisory states that the existing authentication mechanism can be bypassed, allowing remote attackers to reach the vulnerable code path without valid credentials. This combination of authentication bypass and SQL injection enables full remote code execution.
Root Cause
The root cause is improper neutralization of special elements used in an SQL command [CWE-89]. The NVBULibraryPort handler concatenates JSON-RPC message fields directly into SQL query strings instead of using parameterized queries or strict input validation. Attacker-controlled SQL fragments are therefore interpreted as query syntax rather than data.
Attack Vector
The attack vector is network-based and requires no user interaction. An attacker sends a crafted JSON-RPC message to the NVBULibraryPort endpoint, leveraging the documented authentication bypass to reach the vulnerable handler. The crafted message embeds SQL metacharacters within a string parameter that the server uses to build a query. The database engine then executes attacker-controlled SQL, which can be chained to system command execution under the NETWORK SERVICE account. See the Zero Day Initiative Advisory ZDI-26-373 for additional technical context.
No verified proof-of-concept code is publicly available. Refer to the ZDI advisory for the disclosed technical details.
Detection Methods for CVE-2026-9784
Indicators of Compromise
- Unexpected JSON-RPC requests to the NVBULibraryPort service from external or non-administrative hosts
- SQL metacharacters such as single quotes, UNION, --, or stacked statements appearing in NetVault application logs
- Process creation events spawned by NetVault service processes running under NETWORK SERVICE
- Outbound connections from the NetVault server to unfamiliar IP addresses following JSON-RPC activity
Detection Strategies
- Inspect NetVault application and database logs for malformed JSON-RPC payloads targeting NVBULibraryPort handlers
- Alert on child processes (e.g., cmd.exe, powershell.exe) spawned by NetVault binaries, which are not expected during normal backup operations
- Deploy network signatures that flag JSON-RPC messages containing SQL injection patterns directed at NetVault management ports
Monitoring Recommendations
- Forward NetVault server logs and Windows Security/Sysmon events into a centralized SIEM for correlation
- Monitor authentication events on NetVault for repeated or anomalous session establishment that may indicate bypass attempts
- Track outbound traffic from backup servers, which should typically only communicate with managed backup clients and storage targets
How to Mitigate CVE-2026-9784
Immediate Actions Required
- Upgrade Quest NetVault Backup to version 14.0.2 or later as documented in the Quest Release Notes 14.0.2
- Restrict network access to NetVault management ports so that only trusted administrative subnets can reach the service
- Audit NetVault accounts and rotate credentials for any account that may have been exposed prior to patching
Patch Information
Quest addressed CVE-2026-9784 in NetVault Backup 14.0.2. Administrators should review the Quest Release Notes 14.0.2 and apply the update to all NetVault server instances. The Zero Day Initiative Advisory ZDI-26-373 provides additional disclosure details.
Workarounds
- Where immediate patching is not possible, block external access to the NetVault JSON-RPC service at the network firewall
- Place the NetVault server on a dedicated management VLAN reachable only from administrative jump hosts
- Increase logging verbosity on the NetVault server to capture full JSON-RPC payloads for forensic review
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
