Quest NetVault Backup is vulnerable to a SQL Injection flaw in the NVBUDashboard JSON‑RPC processing. The vulnerability stems from an unchecked user‑supplied string that is concatenated directly into SQL queries. An attacker who can reach this endpoint can run arbitrary SQL commands, and because the service executes them in the context of the NETWORK SERVICE account, can achieve remote code execution on the host. The flaw is a CWE‑89 error in input validation, operating with high severity (CVSS 8.8).

This issue affects installations of Quest NetVault Backup, including the NVBUDashboard component. No specific version numbers are listed in the advisory, but all deployments using the NVBUDashboard interface are potentially vulnerable. Administrators should consult the vendor’s release notes for the version that contains the fix.

Although authentication is required to access the vulnerable endpoint, the existing mechanism can be bypassed, allowing remote attackers to reach the JSON‑RPC interface from the network. The lack of proper input validation leads to code execution with elevated privileges. The EPSS score is not available, but the CVSS score of 8.8 indicates a high likelihood of exploitation. The vulnerability is not currently listed in the CISA KEV catalog, but the ability to bypass authentication and execute code makes it a severe threat that should be addressed promptly. The attacker can target the system over the network without needing additional credentials, relying solely on the broken authentication.