CVE-2026-9787: Quest NetVault Backup RCE Vulnerability

CVE-2026-9787 Overview

CVE-2026-9787 is a command injection vulnerability in Quest NetVault Backup that allows remote attackers to execute arbitrary code on affected installations. The flaw resides in the NVBULogDaemon component, which fails to properly validate user-supplied strings in JSON-RPC messages before passing them to a system call. While authentication is required, the existing authentication mechanism can be bypassed, expanding the pool of viable attackers. Successful exploitation grants code execution in the context of SYSTEM. The issue was reported through the Zero Day Initiative as ZDI-CAN-27625 and is tracked under CWE-78 (OS Command Injection).

Critical Impact
Remote attackers can bypass authentication and inject operating system commands through NVBULogDaemon JSON-RPC messages to execute arbitrary code as SYSTEM on backup servers.

Affected Products

Quest NetVault Backup (versions prior to 14.0.2)
NVBULogDaemon component handling JSON-RPC messages
Windows installations running the backup service with SYSTEM privileges

Discovery Timeline

2026-06-25 - CVE-2026-9787 published to NVD
2026-06-25 - Last updated in NVD database

Technical Details for CVE-2026-9787

Vulnerability Analysis

The vulnerability exists within the NetVault Backup NVBULogDaemon service, which exposes a JSON-RPC interface for log management operations. When the daemon processes incoming JSON-RPC messages, it incorporates attacker-controlled string fields into a command string that is subsequently passed to a system shell. Because the daemon performs no sanitization or argument escaping on the supplied parameters, an attacker can append shell metacharacters to break out of the intended command structure and execute arbitrary operating system commands.

NetVault Backup runs as a privileged service on Windows hosts, so commands executed through this flaw inherit the SYSTEM security context. This grants full control over the backup server, including the ability to access stored credentials, tamper with backup data, disable security tooling, and pivot deeper into the environment.

Although the JSON-RPC interface requires authentication, the advisory notes the authentication mechanism itself can be bypassed. Combined with the network-reachable attack surface, this lowers the practical barrier to exploitation against exposed backup infrastructure.

Root Cause

The root cause is improper neutralization of special elements used in an OS command [CWE-78]. The NVBULogDaemon concatenates user-supplied JSON-RPC parameters directly into a system call without validation, allow-listing, or safe argument passing.

Attack Vector

The attack is performed over the network against the NVBULogDaemon JSON-RPC endpoint. After bypassing or satisfying authentication, the attacker submits a crafted JSON-RPC request containing shell metacharacters in a parameter that flows into the vulnerable system call. The injected commands execute as SYSTEM. No verified public proof-of-concept code is available; refer to the Zero Day Initiative Advisory for additional technical detail.

Detection Methods for CVE-2026-9787

Indicators of Compromise

Unexpected child processes spawned by the NetVault Backup service binary, particularly cmd.exe, powershell.exe, or other shell interpreters
Inbound JSON-RPC traffic to NVBULogDaemon containing shell metacharacters such as ;, &, |, backticks, or $() in string fields
New SYSTEM-owned processes, scheduled tasks, or services created shortly after NVBULogDaemon activity
Authentication anomalies against NetVault Backup management interfaces preceding command execution events

Detection Strategies

Monitor process lineage on backup servers for the NetVault daemon spawning interactive shells or LOLBins such as certutil, bitsadmin, or mshta
Inspect JSON-RPC payloads to NVBULogDaemon for suspicious characters and structurally unusual parameter values
Correlate failed-then-successful authentication events on NetVault management endpoints with subsequent process creation telemetry

Monitoring Recommendations

Enable Windows process creation auditing (Event ID 4688) with command-line logging on all NetVault Backup hosts
Forward NetVault service logs and Windows Security logs to a centralized analytics platform for correlation
Alert on outbound network connections originating from the NetVault service process to non-backup destinations

How to Mitigate CVE-2026-9787

Immediate Actions Required

Upgrade Quest NetVault Backup to version 14.0.2 or later as documented in the Quest Release Notes
Restrict network access to NVBULogDaemon and NetVault management interfaces to trusted administrative networks only
Audit existing NetVault Backup accounts and rotate credentials, given the documented authentication bypass
Review backup servers for indicators of prior exploitation, including unauthorized SYSTEM-level activity

Patch Information

Quest has addressed CVE-2026-9787 in NetVault Backup 14.0.2. Administrators should apply the update following Quest's published upgrade procedure. Refer to the Quest Release Notes and the Zero Day Initiative Advisory for complete remediation guidance.

Workarounds

Place NetVault Backup servers behind a firewall or VPN that limits NVBULogDaemon access to known administrative hosts
Disable or block external exposure of the JSON-RPC service port until patching is complete
Apply host-based application control to prevent the NetVault service from spawning shell interpreters

bash

# Configuration example: restrict NVBULogDaemon access with Windows Firewall
# Replace <AdminSubnet> with the administrative CIDR range and <Port> with the NVBULogDaemon port
netsh advfirewall firewall add rule name="NetVault NVBULogDaemon - Admin Only" \
  dir=in action=allow protocol=TCP localport=<Port> remoteip=<AdminSubnet>

netsh advfirewall firewall add rule name="NetVault NVBULogDaemon - Block Other" \
  dir=in action=block protocol=TCP localport=<Port>