CVE-2026-9781

Name of the Vulnerable Software and Affected Versions Quest NetVault Backup (affected versions not specified)

Description A flaw in the processing of NVBURASDevice JSON-RPC messages allows remote attackers to execute arbitrary code in the context of NETWORK SERVICE. The issue stems from insufficient validation of a user-supplied string used to construct SQL queries, leading to SQL injection. Although the exploit typically requires authentication, the authentication mechanism can be bypassed.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.