ADVISORY https://www.zerodayinitiative.com/advisories/ZDI-26-372/

www.zerodayinitiative.com • June 26, 2026

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Quest NetVault Backup. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed.

The specific flaw exists within the processing of NVBURemovableMedia JSON-RPC messages. The issue results from the lack of proper validation of a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to execute code in the context of NETWORK SERVICE.

Quest has issued an update to correct this vulnerability. More details can be found at:

06fe5fd2bc53027c4a3b7e395af0b850e7b8a044

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical SQL Injection Vulnerability in Quest NetVault Backup Disclosed A critical vulnerability, CVE-2026-9783, has been identified in Quest NetVault Backup, allowing remote attackers to execute arbitrary code. This SQL injection flaw is found in the processing of NVBURemovableMedia JSON-RPC messages, where inadequate validation of user-supplied strings leads to SQL query manipulation. Although authentication is required for exploitation, it can be bypassed, increasing the risk of unauthorized access. The vulnerability affects installations of Quest NetVault Backup and can execute code in the context of NETWORK SERVICE. Quest has released an update to address this issue. The CVE was published on June 24, 2026, and security professionals are advised to apply the patch immediately. 1 sources 72

Extracted Entities

ADVISORY https://www.zerodayinitiative.com/advisories/ZDI-26-372/

The full story

Extracted Entities

Attack Types (1)

Companies (1)

CWE Weaknesses (2)

Domains (1)

Platforms (1)

SHA1 Hashes (1)