CVE-2026-9785: Quest NetVault Backup RCE Vulnerability

CVE-2026-9785 Overview

CVE-2026-9785 is a SQL injection vulnerability in Quest NetVault Backup that enables remote code execution. The flaw resides in the processing of NVBULibrarySlot JSON-RPC messages, where user-supplied input is concatenated into SQL queries without proper validation. Although the endpoint requires authentication, the existing authentication mechanism can be bypassed, lowering the practical barrier to exploitation. Successful attackers execute arbitrary code in the context of the NETWORK SERVICE account on the backup server. The issue was reported through the Zero Day Initiative as ZDI-CAN-27630 and assigned [CWE-89]. Quest addressed the defect in NetVault Backup 14.0.2.

Critical Impact
Remote attackers can bypass authentication and execute arbitrary code as NETWORK SERVICE on Quest NetVault Backup servers, compromising enterprise backup infrastructure.

Affected Products

Quest NetVault Backup (versions prior to 14.0.2)
Quest NetVault Backup server component handling JSON-RPC messages
Deployments exposing the NetVault management service to untrusted networks

Discovery Timeline

2026-06-25 - CVE-2026-9785 published to NVD
2026-06-25 - Last updated in NVD database
ZDI-CAN-27630 / ZDI-26-374 - Coordinated disclosure tracked by the Zero Day Initiative

Technical Details for CVE-2026-9785

Vulnerability Analysis

The vulnerability is a SQL injection flaw [CWE-89] in the JSON-RPC handler that processes NVBULibrarySlot messages. NetVault Backup accepts JSON-RPC requests over the network and uses values from those messages to build database queries. The handler does not sanitize or parameterize a user-controlled string before concatenating it into the SQL statement. An authenticated attacker can inject arbitrary SQL syntax through this field. Because the authentication mechanism guarding the endpoint can be bypassed, the practical authentication requirement collapses, allowing remote network attackers to reach the vulnerable code path.

The injected SQL executes within the database backend used by NetVault Backup. Attackers can leverage the SQL injection primitive to achieve code execution in the context of the NETWORK SERVICE account on Windows hosts. This provides a foothold on the backup server, which typically holds credentials and access paths to large portions of the enterprise estate.

Root Cause

The root cause is improper neutralization of special elements used in an SQL command. The NVBULibrarySlot handler constructs SQL queries by concatenating user-supplied strings rather than using parameterized queries or prepared statements. This pattern matches the [CWE-89] weakness class and produces classic string-based SQL injection.

Attack Vector

The vulnerability is reachable over the network through JSON-RPC messages exposed by the NetVault Backup service. An attacker first bypasses the authentication mechanism, then submits a crafted NVBULibrarySlot JSON-RPC request containing malicious SQL payloads in the vulnerable parameter. The injected query manipulates the backend database and is escalated to code execution as NETWORK SERVICE. Because backup servers are high-value targets, this access can be used to stage ransomware, exfiltrate backup data, or destroy recovery points.

No verified public exploit code is available at the time of writing. Refer to the Zero Day Initiative Advisory ZDI-26-374 for additional technical context.

Detection Methods for CVE-2026-9785

Indicators of Compromise

Unexpected JSON-RPC requests targeting NVBULibrarySlot methods, especially containing SQL metacharacters such as ', --, ;, or UNION.
Child processes spawned by NetVault Backup service binaries running as NETWORK SERVICE, particularly cmd.exe, powershell.exe, or scripting interpreters.
New or modified scheduled tasks, services, or persistence artifacts on the NetVault server following inbound management traffic.
Anomalous outbound connections from the NetVault host to attacker infrastructure shortly after authentication events.

Detection Strategies

Inspect application and database logs for malformed SQL statements originating from the NetVault Backup service account.
Alert on authentication anomalies against the NetVault management interface, including repeated failed logins followed by successful sessions from new sources.
Monitor process lineage on backup servers and treat any non-backup child process of the NetVault service as high priority.
Apply network signatures to JSON-RPC traffic that contain SQL injection patterns within NVBULibrarySlot parameter fields.

Monitoring Recommendations

Centralize NetVault Backup server logs, Windows security logs, and database audit logs in a SIEM for correlation.
Baseline normal JSON-RPC method usage and alert on rare or previously unseen methods invoked against the service.
Continuously monitor backup infrastructure for outbound connections and credential access attempts following management plane activity.

How to Mitigate CVE-2026-9785

Immediate Actions Required

Upgrade Quest NetVault Backup to version 14.0.2 or later as documented in the Quest Release Notes 14.0.2.
Restrict network access to the NetVault Backup management interface so that only trusted administrative hosts can reach the JSON-RPC service.
Rotate credentials and review service account permissions on hosts running NetVault Backup, including any cached domain credentials.
Audit backup servers for indicators of prior exploitation, including unexpected processes spawned by the NetVault service.

Patch Information

Quest released the fix in NetVault Backup 14.0.2. The vendor advisory and changelog are available in the Quest Release Notes 14.0.2. Coordinated disclosure details are published in Zero Day Initiative Advisory ZDI-26-374.

Workarounds

Place the NetVault Backup management endpoint behind a firewall or VPN limited to administrative jump hosts until patching is complete.
Disable or block external access to JSON-RPC endpoints that expose NVBULibrarySlot functionality where operationally feasible.
Enforce network segmentation between backup infrastructure and general user networks to limit lateral movement opportunities.
Increase logging verbosity on the NetVault service and the underlying database to support incident response if exploitation is suspected.

bash

# Example: restrict access to the NetVault management port using Windows Firewall
# Replace <ADMIN_SUBNET> with your administrative network range and <PORT> with the NetVault management port
netsh advfirewall firewall add rule name="Restrict NetVault Mgmt" ^
  dir=in action=block protocol=TCP localport=<PORT>
netsh advfirewall firewall add rule name="Allow NetVault Mgmt Admins" ^
  dir=in action=allow protocol=TCP localport=<PORT> remoteip=<ADMIN_SUBNET>