CVE-2026-9785: Quest NetVault Backup NVBULibrarySlot SQL Injection Remote Code Execution Vulnerability
Quest NetVault Backup NVBULibrarySlot SQL Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Quest NetVault Backup. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed.
The specific flaw exists within the processing of NVBULibrarySlot JSON-RPC messages. The issue results from the lack of proper validation of a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to execute code in the context of NETWORK SERVICE. Was ZDI-CAN-27630.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-9785?
The severity of CVE-2026-9785 is rated high with a CVSS score of 8.8.
How do I fix CVE-2026-9785?
To fix CVE-2026-9785, upgrade to the latest version of Quest NetVault Backup that addresses this SQL Injection vulnerability.
What type of vulnerability is CVE-2026-9785?
CVE-2026-9785 is categorized as an SQL Injection vulnerability that can lead to remote code execution.
Can CVE-2026-9785 be exploited remotely?
Yes, CVE-2026-9785 can be exploited remotely, although authentication is required.
What impact does CVE-2026-9785 have on affected systems?
CVE-2026-9785 allows remote attackers to execute arbitrary code on affected installations of Quest NetVault Backup.