# CVE-2026-9784: Quest NetVault Backup SQL injection in NVBULibraryPort

Source: https://junglewise.ai/threats/cve-2026-9784-quest-netvault-backup-sql-injection-in-nvbulibraryport  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-25. Updated: 2026-06-25  
License: CC BY 4.0 with a link back

CVE-2026-9784 · Severity: high · CVSS 8.8 · Published 2026-06-25

Quest NetVault Backup is a data protection solution used to back up and recover enterprise data across physical and virtual environments. A security flaw in how the software handles database queries allows a remote attacker to bypass security checks and execute unauthorized commands. This could lead to a complete takeover of the backup server, potentially resulting in the loss or theft of sensitive corporate data and backups.

Technologies: [Quest NetVault Backup](https://junglewise.ai/threats/technologies/netvault-backup). Vendors: [Quest](https://junglewise.ai/threats/vendors/quest).

## Quick answers

**Is CVE-2026-9784 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-9784 being exploited in the wild.

**How severe is CVE-2026-9784?** High severity, with a CVSS score of 8.8, published 25 June 2026.

**Which products and versions are affected?** Quest NetVault Backup 14.0.0.19.

**Is there a fix for CVE-2026-9784?** A patch was published on 2026-06-24: Vendor released version 14.0.2 to address the issue Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-9784 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-9784?** Check whether you run Quest NetVault Backup at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An SQL injection vulnerability exists within the NVBULibraryPort component of Quest NetVault Backup during the processing of JSON-RPC messages. The root cause is a failure to properly validate user-supplied strings before they are used to construct SQL queries. While the vulnerability technically requires authentication, the advisory notes that the existing authentication mechanism can be bypassed. A remote attacker can exploit this flaw to execute arbitrary code in the context of the NETWORK SERVICE account. The issue was addressed in version 14.0.2.

## Affected products

- Quest NetVault Backup 14.0.0.19

## Timeline

- 2025-09-24: disclosed: Vulnerability reported to vendor via ZDI
- 2026-06-24: patched: Vendor released version 14.0.2 to address the issue
- 2026-06-24: advisory: Coordinated public release of advisory ZDI-26-373

## References

- [https://support.quest.com/technical-documents/netvault/14.0.2/release-notes](https://support.quest.com/technical-documents/netvault/14.0.2/release-notes)
- [https://www.zerodayinitiative.com/advisories/ZDI-26-373/](https://www.zerodayinitiative.com/advisories/ZDI-26-373/)

## Related threats

- [Quest NetVault Backup nvpmgr integer underflow denial-of-service](https://junglewise.ai/threats/cve-2026-13270-quest-netvault-backup-nvpmgr-integer-underflow-denial-of-service)
- [Quest NetVault Backup numeric truncation error denial of service](https://junglewise.ai/threats/cve-2026-13269-quest-netvault-backup-stnzcreatekey-numeric-truncation-error)
- [Quest NetVault Backup command injection in NVBULogDaemon](https://junglewise.ai/threats/cve-2026-9787-quest-netvault-backup-command-injection-in-nvbulogdaemon)
- [Quest NetVault Backup SQL injection in NVBUDashboard](https://junglewise.ai/threats/cve-2026-9786-quest-netvault-backup-sql-injection-in-nvbudashboard)
- [Quest NetVault Backup SQL injection in NVBULibrarySlot](https://junglewise.ai/threats/cve-2026-9785-quest-netvault-backup-sql-injection-in-nvbulibraryslot)