CVE-2026-9781

HighCVSS 8.8/10Last modified Jun 26, 2026

Description

Quest NetVault Backup NVBURASDevice SQL Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Quest NetVault Backup. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed.

The specific flaw exists within the processing of NVBURASDevice JSON-RPC messages. The issue results from the lack of proper validation of a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to execute code in the context of NETWORK SERVICE. Was ZDI-CAN-27648.

Metrics

CVSS 3.0 8.8/10CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

No affected versions have been published.

Timeline

Published: Jun 25, 2026
Last modified: Jun 26, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-978107.0Heap-based buffer overflow in Windows Container Isolation FS Filter Driver (unionfs.sys) allows an authorized attacker to elevate privileges CVE-2026-978117.8Double free in OpenSSH for Windows allows an authorized attacker to elevate privileges locally.CVE-2026-978127.0Double free in Windows Update Orchestrator Service allows an authorized attacker to elevate privileges locally.CVE-2026-978136.5Heap-based buffer overflow in Windows Hyper-V allows an authorized attacker to disclose information over a network.CVE-2026-978149.8Heap-based buffer overflow in Windows Text Shaping allows an unauthorized attacker to execute code over a network.CVE-2026-978159.8Heap-based buffer overflow in Windows Error Reporting allows an unauthorized attacker to execute code over a network.CVE-2026-978169.8Use after free in OpenSSH for Windows allows an unauthorized attacker to execute code over a network.CVE-2026-978176.5Heap-based buffer overflow in DNS Server allows an authorized attacker to disclose information over a network.CVE-2026-978188.6phpIPAM through 1.8.3 has incorrect authorization for id=="admins" and id=="all" in api/controllers/User.php.CVE-2026-978196.5Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network.CVE-2026-97828.8Quest NetVault Backup NVBUDeviceDrive SQL Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execu CVE-2026-978206.5Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network.