# CVE-2026-9787: Quest NetVault Backup command injection in NVBULogDaemon

Source: https://junglewise.ai/threats/cve-2026-9787-quest-netvault-backup-command-injection-in-nvbulogdaemon  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-25. Updated: 2026-06-25  
License: CC BY 4.0 with a link back

CVE-2026-9787 · Severity: high · CVSS 8.8 · Published 2026-06-25

Quest NetVault Backup is an enterprise data protection solution used to back up and recover data across physical and virtual environments. A security flaw in its logging component allows a remote attacker to bypass authentication and execute commands with administrative (SYSTEM) privileges. This could lead to a total compromise of the backup server, potentially allowing attackers to delete backups, steal sensitive data, or deploy ransomware across the infrastructure.

Technologies: [Quest NetVault Backup](https://junglewise.ai/threats/technologies/netvault-backup). Vendors: [Quest](https://junglewise.ai/threats/vendors/quest).

## Quick answers

**Is CVE-2026-9787 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-9787 being exploited in the wild.

**How severe is CVE-2026-9787?** High severity, with a CVSS score of 8.8, published 25 June 2026.

**Which products and versions are affected?** Quest NetVault Backup Versions prior to 14.0.2.

**Is there a fix for CVE-2026-9787?** A patch was published on 2026-06-24: Quest released version 14.0.2 to address the issue Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-9787 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-9787?** Check whether you run Quest NetVault Backup at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A command injection vulnerability exists within the NVBULogDaemon component of Quest NetVault Backup due to improper validation of user-supplied strings in JSON-RPC messages. While the vulnerable function technically requires authentication, the existing authentication mechanism can be bypassed, making the flaw reachable by unauthenticated remote attackers. The root cause is the lack of sanitization of input before it is passed to a system call. Successful exploitation allows for remote code execution in the security context of SYSTEM. Quest has addressed this issue in NetVault Backup version 14.0.2.

## Affected products

- Quest NetVault Backup Versions prior to 14.0.2

## Timeline

- 2025-09-24: disclosed: Vulnerability reported to vendor
- 2026-06-24: patched: Quest released version 14.0.2 to address the issue
- 2026-06-24: advisory: Coordinated public release of advisory

## References

- [https://support.quest.com/technical-documents/netvault/14.0.2/release-notes](https://support.quest.com/technical-documents/netvault/14.0.2/release-notes)
- [https://www.zerodayinitiative.com/advisories/ZDI-26-376/](https://www.zerodayinitiative.com/advisories/ZDI-26-376/)

## Related threats

- [Quest NetVault Backup nvpmgr integer underflow denial-of-service](https://junglewise.ai/threats/cve-2026-13270-quest-netvault-backup-nvpmgr-integer-underflow-denial-of-service)
- [Quest NetVault Backup numeric truncation error denial of service](https://junglewise.ai/threats/cve-2026-13269-quest-netvault-backup-stnzcreatekey-numeric-truncation-error)
- [Quest NetVault Backup SQL injection in NVBUDashboard](https://junglewise.ai/threats/cve-2026-9786-quest-netvault-backup-sql-injection-in-nvbudashboard)
- [Quest NetVault Backup SQL injection in NVBULibrarySlot](https://junglewise.ai/threats/cve-2026-9785-quest-netvault-backup-sql-injection-in-nvbulibraryslot)
- [Quest NetVault Backup SQL injection in NVBULibraryPort](https://junglewise.ai/threats/cve-2026-9784-quest-netvault-backup-sql-injection-in-nvbulibraryport)