ZDI 2026-06-24

ZDI-26-376: Quest NetVault Backup NVBULogDaemon Command Injection Remote Code Execution Vulnerability

CVE-2026-9787

Machine-generated analysis · WAYSCloud LLM

Authentication is required to exploit the vulnerability, but the advisory notes the authentication mechanism can be bypassed.

Context

The affected product is Quest NetVault Backup, specifically the NVBULogDaemon component. The vulnerability is a command injection issue that allows remote code execution. Worth noting that the authentication bypass may expand the attack surface despite the requirement. The CVSS score is rated 8.8, indicating high severity according to the ZDI.

Operator considerations

Check: Inventory Quest NetVault Backup instances running the NVBULogDaemon service.

From Zero Day Initiative ↗

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Quest NetVault Backup. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The ZDI has assigned a CVSS rating of 8.8. The following CVEs are assigned: CVE-2026-9787.

Read the full advisory on ZDI →