CVE-2026-9787

Think of NVBULogDaemon as a “log service” that listens for remote requests. This flaw is like a cracked door lock: if someone sends the right kind of message, the service can be tricked into running operating-system commands on your server—using the highest privilege level (Windows SYSTEM).

This matters if your business uses Quest NetVault Backup and you have the NVBULogDaemon component running on a server that can be reached from the network. Based on the findings, the issue can be triggered remotely, and it can lead to code running with SYSTEM privileges.

Because the findings do not confirm the exact authentication requirement or the default reachability, treat it as a risk when the NVBULogDaemon JSON-RPC endpoint is reachable from outside your tightly controlled network (or reachable from untrusted internal networks).

This is AMBER because the vulnerability enables remote code execution with SYSTEM privileges, which can turn into complete compromise if the service is reachable. There is no public exploit code listed and CISA has not added it to its KEV catalog, so active exploitation is not confirmed.

Still, the risk is high-impact: if an attacker can reach the JSON-RPC processing, this is the kind of bug ransomware operators would target. Focus first on whether the affected service is exposed and whether any Quest remediation becomes available.

Confirm exposure

1. Identify your NetVault Backup deployment: which servers run Quest NetVault Backup.
2. Determine whether NVBULogDaemon is present and running on those servers.
3. Check network exposure:
   • From an admin workstation and/or a network scanning tool approved by your IT/security process, confirm whether the NVBULogDaemon JSON-RPC endpoint is reachable from:
     • the local machine only (best case),
     • internal networks,
     • and/or the internet.

Determine vulnerability status

4. Collect the exact NetVault Backup version(s) installed and the patch level.
5. Search Quest’s support site and any NetVault release notes/hotfix bulletins for CVE-2026-9787.
   • The findings currently indicate no fix/patch information is available, so you must rely on Quest’s guidance for an official remediation build.

Mitigate if you can’t patch yet (or before patching)

6. Restrict reachability immediately:
   • Firewall allow-listing so the JSON-RPC endpoint is reachable only from the specific trusted hosts that need it.
   • If you use VPN for admin access, ensure access flows through that trusted path only.
   • Block all public/internet-origin access.
7. Ensure you aren’t exposing backup infrastructure management endpoints to broad networks (e.g., flat office LANs) unless strictly required.

After a fix is released

8. Upgrade to the first Quest-provided NetVault Backup build that fixes CVE-2026-9787.
9. Re-check endpoint reachability after upgrade to ensure firewall rules are still correct.

What to monitor

10. Review logs on the NetVault Backup server for unusual or repeated JSON-RPC requests targeting NVBULogDaemon, especially malformed or unexpected patterns.
11. Monitor for signs of system-level execution tied to the NetVault host (e.g., new scheduled tasks, unexpected processes, or creation of new binaries/scripts), and coordinate with your incident response process if anything suspicious appears.

KEV / due date

• CISA KEV: not listed in the KEV catalog, so no CISA-specific remediation deadline is provided by the findings.

CVE-2026-9787 affects Quest NetVault Backup, specifically the NVBULogDaemon service that processes JSON-RPC messages. The weakness is command injection (CWE-78): a user-supplied string is not properly validated before being used in a system-call context, enabling attackers to inject and execute arbitrary commands.

Impact: the findings state remote code execution with SYSTEM privileges, which is consistent with a full host compromise potential.

Attack vector: remote exploitation via command injection in JSON-RPC message processing, with no user interaction required.

Exploitation status: no public exploit code on record; not listed in CISA KEV.

Patch status: no fix/patch information is available in the findings, so there is currently no confirmed “fixed version” to upgrade to.

Note on authentication: the detailed description says authentication is required but may be bypassable; the findings do not confirm the exact requirement or preconditions. Practically, exposure is the key risk driver—if the JSON-RPC endpoint is reachable from untrusted networks, the risk rises sharply.