The vulnerability is a SQL injection flaw in the NVBULibrarySlot JSON‑RPC handler of Quest NetVault Backup. The bug results from insufficient sanitization of a user‑supplied string that is later incorporated into SQL statements, allowing an attacker to inject arbitrary SQL. When successful, the injection grants code execution privileges under the NETWORK SERVICE account. Although the product requires authentication to access the endpoint, the authentication mechanism can be bypassed, so a remote attacker can obtain the necessary privileges without valid credentials.

Quest NetVault Backup is affected. No specific version information is supplied in the CNA data, but the issue is documented in the 14.0.2 release notes.

The CVSS score of 8.8 indicates a high severity level. EPSS information is unavailable, so exploitation probability is unknown, and the vulnerability is not currently listed in CISA’s KEV catalog. The flaw can be exploited remotely through the JSON‑RPC interface, and an attacker can bypass authentication controls, enabling arbitrary code execution and potentially compromising the entire backup system and underlying host.