10 Flaws in Quest NetVault Backup: What CVE-2026-9787 Really Does

Quest's enterprise backup software, NetVault Backup, has been hit with 10 serious vulnerabilities at once. Every one is rated 8.8 out of 10 (High). Two of them let an attacker slip past the login, and one (CVE-2026-9787) lets an attacker take over the server and run any command they want. The flaws were found and reported by Trend Micro's Zero Day Initiative (ZDI), one of the world's largest vulnerability research programs, and all 10 were published on June 24, 2026.

The fix is to update to NetVault Backup 14.0.2. Both ZDI and the U.S. National Vulnerability Database (NVD) point to Quest's 14.0.2 release notes as the remediation. A backup product is the "last line of defense" with reach into every piece of company data — which makes it exactly what attackers most want to seize. Servers that expose the management console to the internet should be updated first.

[Update, August 17, 2026] Two months on, no exploitation has been confirmed

About two months have passed since disclosure, so here is where things stand. As of August 17, 2026, there is no confirmed report of these 10 flaws being used in a real attack. We checked the August 14, 2026 edition of the Known Exploited Vulnerabilities catalog (KEV) published by CISA — the U.S. government agency responsible for defending the country's critical infrastructure — and none of the 10 appear in it. No new proof-of-concept code (a sample exploit that demonstrates the attack works) has been published, and no additional advisory from Quest has been confirmed. The NVD entry for CVE-2026-9787 still shows published June 25, 2026 and last modified June 26, 2026, with no changes since.

The likelihood of exploitation also remains low. EPSS — a score that statistically estimates the probability a flaw will be exploited within the next 30 days — sits at 0.0140 (1.4%) for CVE-2026-9787, which places it at the 70.25th percentile. That number says attackers have not yet turned their attention here; it does not say the danger is gone. But it does mean this is not something that warrants an emergency maintenance window tonight. The action is the same as it was in June: move to 14.0.2 on a planned schedule, through your normal change management.

One correction as well. The first edition was written in a way that let CVE-2026-9787, the most severe of the 10, read as the flagship example of "authentication bypass." To be precise, CVE-2026-9787 is remote code execution as SYSTEM via OS command injection (CWE-78), not an authentication bypass. It is CVSS 8.8 with the vector AV:N/AC:L/PR:L/UI:N, and as PR:L indicates, one low-privileged account is required. What ZDI-26-376 says is "authentication is required, however the existing authentication mechanism can be bypassed" — which is not the same as needing no authentication at all. The only pure authentication bypasses among the 10 are CVE-2026-9780 and CVE-2026-7569, both of which work through XSS (planting a malicious script in a web page). Those two pry the door open; CVE-2026-9787 takes the highest privilege. That is the correct way to read the set.

The first edition also lacked a mapping between the 10 CVEs and their ZDI advisory numbers. It has been added below, under "The 10 flaws and their ZDI advisory numbers."

What Quest NetVault Backup is, and why it gets targeted

Quest NetVault Backup is enterprise backup and disaster-recovery software from Quest Software (formerly part of Dell). It protects and restores data across physical servers, virtual machines (VMware, Hyper-V, Nutanix), cloud, and applications such as Microsoft 365 and databases (SQL Server, Oracle). It is used by mid-sized to large organizations and scales to tens of petabytes (now offered as "NetVault Plus").

Backup products are high-value targets for a reason. Backup concentrates almost all of an organization's data in one place, so whoever controls the management server can both steal the contents and destroy the ability to recover. In modern ransomware attacks it is now standard to wipe the backups first, then encrypt the production systems and demand payment. As seen in ransomware incidents hitting manufacturers, how backups are handled often decides the outcome. These 10 flaws are holes in that last line of defense itself.

Who targets this, and what they take

What makes these flaws dangerous is that the entry point is the management console you use every day. Here is who would use it as a foothold.

The likely attackers are intruders already inside the corporate network, and ransomware crews scanning for servers that expose the management console to the internet. What they want is the company's own data piled up in backups — customer records, financials, designs — and the "no longer recoverable" state they can hold hostage. Two of these flaws let an attacker bypass the login that should be required, so even someone without a valid ID or password can gain a foothold simply by getting an administrator to click a crafted link.

The remaining eight, once the management console is reachable, let an attacker smuggle malicious commands into input fields and run programs of their choosing on the server. For these eight, ZDI's wording is "authentication is required, however the existing authentication mechanism can be bypassed" — which is not the same as needing no authentication at all. In the worst case the server's highest privilege (SYSTEM) is seized, and the backup server becomes the attacker's tool. From there, the damage can spread to connected production systems and other servers.

The "8.8" score is only a gauge of technical severity. What an organization actually loses is the data it was entrusted with, and the very "recovery insurance" it expected to fall back on. A mechanism meant to protect backups becoming the way in — that is the heart of these 10 flaws.

The 10 flaws at a glance

The 10 split into three groups by entry point and technique. All are CVSS 8.8 (High).

"XSS" (cross-site scripting) means slipping a malicious script into a web page; the two XSS flaws here can bypass the intended login, so they serve as the starting point of an attack. "SQL injection" means mixing rogue commands into the statements used to query data, which here escalates to running code on the server (RCE, remote code execution). "Command injection" is the most direct route — making the server run commands outright. The eight injection flaws all stem from how the management traffic (a mechanism called JSON-RPC) is processed.

"Required (bypassable)" in the Login column reflects ZDI's wording: "authentication is required, however the existing authentication mechanism can be bypassed." It does not mean no authentication is needed to begin with — the CVSS vector rates these as PR:L (low privileges required). The only two that work with no login at all are the XSS flaws.

The 10 flaws and their ZDI advisory numbers

The 10 were numbered consecutively from ZDI-26-368 to ZDI-26-377 and all published on June 24, 2026. The fix for every one is 14.0.2. When cross-checking against an asset inventory or internal tickets, the ZDI number is usually the faster route back to the original advisory, so here is the mapping.

ZDI advisories also carry the disclosure timeline. The most severe of them, ZDI-26-376 (CVE-2026-9787), was reported to the vendor on September 24, 2025 and published on June 24, 2026 — nine months from report to disclosure. Turn that around and it means the hole existed for nine months before the world heard about it. Publication did not make these servers dangerous; publication is what finally let their owners do something about it.

The individual flaws

CVE-2026-9787: command injection to SYSTEM (most severe)

The "NVBULogDaemon" log-handling component runs a user-supplied string as a system command without proper validation (CWE-78, OS command injection). A successful attack runs arbitrary commands as SYSTEM, the server's highest privilege. It is CVSS 8.8 with the vector AV:N/AC:L/PR:L/UI:N (ZDI-26-376). This is not an authentication bypass. One low-privileged account is required, and ZDI's caveat is that "authentication is required, however the existing authentication mechanism can be bypassed." Classified properly it is remote code execution, and it is the most impactful of the 10.

CVE-2026-7569 / CVE-2026-9780: login-bypassing XSS

In the "viewclient" (CVE-2026-7569) and "addclient3" (CVE-2026-9780) management pages, insufficient input validation allows a malicious script to be injected (CWE-79). Both work without a login and serve as the point that breaks past the intended authentication. These two are the only flaws among the 10 that qualify as authentication bypasses. They require a user to open a crafted page, but chained with the other flaws they can lead all the way to code execution as SYSTEM (ZDI-26-369 / ZDI-26-377).

CVE-2026-7570 / 9781 / 9782 / 9783 / 9784 / 9785 / 9786: SQL injection to code execution (7)

The remaining seven flaws sit in several components that handle management traffic, each folding an unvalidated string into a database statement (CWE-89, SQL injection). They span the dashboard (NVBUDashboard: CVE-2026-7570 and 9786) and the device/media management parts (NVBURASDevice, NVBUDeviceDrive, NVBURemovableMedia, NVBULibraryPort, NVBULibrarySlot). All lead to code execution on the server (as NETWORK SERVICE), with authentication required but bypassable — the same class of flaw recurring across multiple input points.

Are you affected?

Affected organizations are those running Quest NetVault Backup (the 14.0.x line). Public ZDI/NVD data lists the tested versions as 14.0.1.7 for the two XSS flaws and 14.0.0.19 for the eight injection flaws (the numbers differ because each report was validated on a single build; this does not mean earlier versions are safe). Use the table below to gauge your risk.

None of the 10 are currently listed in CISA's Known Exploited Vulnerabilities catalog (KEV), and no real-world exploitation has been reported. Even so, backup products — like file-transfer and VPN gear — are a category that has repeatedly ended up in KEV. Now that details are public, act before attack attempts ramp up.

What to do

The core fix is to update NetVault Backup to 14.0.2 or later. Quest's official 14.0.2 release notes describe it as including "Web UI security fixes," and all 10 ZDI/NVD advisories reference these same release notes as the remediation. On existing deployments, check your running version first and plan the move to 14.0.2.

If you cannot update immediately, you can reduce risk by taking the management console (Web UI) off the internet, restricting which devices and networks can reach it, and reminding administrators not to open links from unknown sources. Because the two XSS flaws start with "getting an admin to click a link," that reminder genuinely helps. These are stopgaps, though — updating is the real fix. Keep in mind that backup servers are a top-priority target for attackers, so they deserve priority over other infrastructure.

Confirmed facts and open questions

FAQ

Q. Will damage happen right away?

A. No real-world exploitation has been reported so far, and none are in CISA KEV. But now that the details are public, attack attempts may increase. If your management console is exposed externally, update urgently.

Q. If a login is required, are we safe as long as it's internal-only?

A. Don't count on it. Two of the 10 can bypass the login, and ZDI rates the other eight as bypassable too. An intruder already inside the network could also abuse them as a stepping stone to other servers.

Q. Which version should we update to?

A. 14.0.2 or later. Both ZDI and NVD point to Quest's 14.0.2 release notes as the fix. Note that Quest's release notes still mark the relevant CVEs as "pending," but every source agrees the fixed version is 14.0.2.

Bottom line

The 10 flaws in Quest NetVault Backup are all rated 8.8 and serious — from bypassing authentication to full server takeover (code execution at the highest SYSTEM privilege). Backup is the aggregation point for company data and the "last line of defense" that ransomware crews hit first. Update to the fixed 14.0.2 before that defensive mechanism becomes the way in.

If you can't update immediately, take the management console off the internet and narrow who can reach it to reduce risk. No exploitation has been reported yet, but with the details public, the faster you act the safer you are. This is also a good moment to inventory the versions and support status of the software you run.

References

• ▸Zero Day Initiative - Published Advisories (ZDI-26-368 to 377)
• ▸ZDI-26-376 - NVBULogDaemon command injection (CVE-2026-9787)
• ▸ZDI-26-369 - addclient3 XSS (CVE-2026-9780)
• ▸NVD - CVE-2026-9787 Detail
• ▸NVD - CVE-2026-7569 Detail
• ▸Quest - NetVault Backup 14.0.2 Release Notes
• ▸Quest - NetVault Plus product page
• ▸ZDI-26-377 - viewclient XSS (CVE-2026-7569)
• ▸CISA - Known Exploited Vulnerabilities Catalog (KEV; checked against the August 14, 2026 edition)
• ▸FIRST - EPSS (exploit prediction scoring system)