The flaw lies in the handling of NVBURASDevice JSON‑RPC messages, where an unsanitized user‑supplied string is directly incorporated into SQL queries. This omission permits an attacker to inject arbitrary SQL and ultimately execute code with the privileges of the NETWORK SERVICE account. Though the product requires authentication, the existing mechanism can be bypassed, allowing unauthenticated attackers to access the vulnerable endpoint. The resulting code execution could compromise confidentiality, integrity, and availability of the affected system.

Quest NetVault Backup installations that have not applied the latest patch or upgrade. The vulnerability is tied specifically to the NVBURASDevice JSON‑RPC component, hence any deployment that exposes this interface to the network is potentially vulnerable. Version specifics are not enumerated in the data, so all public‑facing instances of NetVault Backup are at risk until mitigated.

The CVSS score of 8.8 categorizes this issue as High severity. EPSS data is not available, making the current exploitation probability unclear, but the lack of authentication is mitigated only by a bypass that could be discovered or already in use. The vulnerability is not listed in the CISA KEV catalog, suggesting no publicly confirmed exploits yet, yet the remote nature of the attack vector and the ability to bypass authentication elevate the risk. The attack is likely to proceed over the network through the JSON‑RPC endpoint, requiring no local privileges.