CVE-2026-9786: Quest NetVault Backup RCE Vulnerability

CVE-2026-9786 Overview

CVE-2026-9786 is a SQL injection vulnerability in the NVBUDashboard component of Quest NetVault Backup. The flaw allows remote attackers to execute arbitrary code on affected installations. While the vulnerability requires authentication, the existing authentication mechanism can be bypassed, expanding the pool of potential attackers. Successful exploitation runs code in the context of the NETWORK SERVICE account on the target host. The issue was reported through the Trend Micro Zero Day Initiative as ZDI-CAN-27626 and disclosed publicly as ZDI-26-375. Quest addressed the issue in NetVault 14.0.2.

Critical Impact
Remote attackers can bypass authentication and execute arbitrary code as NETWORK SERVICE by injecting SQL through NVBUDashboard JSON-RPC messages.

Affected Products

Quest NetVault Backup (versions prior to 14.0.2)
NVBUDashboard component processing JSON-RPC messages
Windows installations running NetVault under the NETWORK SERVICE account

Discovery Timeline

2026-06-25 - CVE-2026-9786 published to NVD
2026-06-25 - Last updated in NVD database
ZDI-CAN-27626 / ZDI-26-375 - Zero Day Initiative advisory published

Technical Details for CVE-2026-9786

Vulnerability Analysis

The vulnerability resides in the NVBUDashboard component of Quest NetVault Backup. NVBUDashboard exposes a JSON-RPC interface that processes user-supplied parameters as part of database queries. The component fails to properly validate or parameterize a user-supplied string before incorporating it into SQL statements. This classification falls under [CWE-89] Improper Neutralization of Special Elements used in an SQL Command.

Attackers reach the vulnerable code path over the network. The advisory states that authentication is required, but the existing authentication mechanism can be bypassed. This effectively reduces the exploitation barrier to a network-reachable NetVault deployment. Successful SQL injection enables code execution in the context of the NETWORK SERVICE Windows account, providing a foothold for further lateral movement against backup infrastructure.

Root Cause

The root cause is the lack of proper validation and sanitization of a user-supplied string passed through JSON-RPC requests to NVBUDashboard. The string is concatenated into an SQL query rather than being bound as a parameter. Backup servers typically hold privileged access to file shares, databases, and credentials, which amplifies the downstream impact of compromise.

Attack Vector

An attacker sends a crafted JSON-RPC message to the NVBUDashboard endpoint. The message includes a malicious payload in a field that NetVault subsequently uses to build a database query. By injecting SQL syntax, the attacker manipulates the query to invoke database functionality that leads to operating system command execution. The combination of network reachability, authentication bypass, and code execution as NETWORK SERVICE makes this a viable pivot point into enterprise environments. See the Zero Day Initiative Advisory ZDI-26-375 for additional technical context.

Detection Methods for CVE-2026-9786

Indicators of Compromise

Unexpected child processes spawned by NetVault service binaries running under the NETWORK SERVICE account.
Anomalous JSON-RPC requests to NVBUDashboard endpoints containing SQL metacharacters such as single quotes, UNION, xp_cmdshell, or stacked queries.
Outbound network connections originating from the NetVault host to unfamiliar external IP addresses.
New or modified scheduled tasks, services, or local accounts on the NetVault server following dashboard access.

Detection Strategies

Inspect NetVault application and web server logs for JSON-RPC requests with malformed or suspicious string parameters.
Hunt for process lineage where NetVault dashboard processes spawn cmd.exe, powershell.exe, or wmic.exe.
Correlate authentication events on NetVault with subsequent dashboard activity to identify bypass patterns.

Monitoring Recommendations

Forward NetVault host telemetry, including process, file, and network events, to a centralized analytics platform.
Alert on database query errors emitted by NetVault that contain syntax indicative of injection attempts.
Monitor for changes to backup job definitions, credentials, and stored configuration that could indicate post-exploitation activity.

How to Mitigate CVE-2026-9786

Immediate Actions Required

Upgrade Quest NetVault Backup to version 14.0.2 or later as documented in the Quest Release Notes 14.0.2.
Restrict network access to the NVBUDashboard interface to trusted administrative subnets only.
Review NetVault accounts and rotate credentials for any account that may have authenticated to the dashboard.
Audit recent dashboard activity and process execution on NetVault servers for signs of exploitation.

Patch Information

Quest has released NetVault 14.0.2 to address this vulnerability. Administrators should consult the Quest Release Notes 14.0.2 for upgrade prerequisites and procedures. Apply the update on all NetVault servers, including management and media nodes, before re-exposing the dashboard interface.

Workarounds

Place the NetVault management interface behind a VPN or jump host until patching is complete.
Apply host-based firewall rules that limit access to NVBUDashboard ports to specific administrator workstations.
Disable the NVBUDashboard component on systems where it is not actively required.

bash

# Example: Windows firewall rule restricting NVBUDashboard access to a management subnet
netsh advfirewall firewall add rule name="Restrict NetVault Dashboard" ^
  dir=in action=block protocol=TCP localport=8443 remoteip=any

netsh advfirewall firewall add rule name="Allow NetVault Dashboard Admins" ^
  dir=in action=allow protocol=TCP localport=8443 remoteip=10.10.20.0/24