CVE-2026-9787

Think of NVBULogDaemon as a “log service” that listens for remote requests. This flaw is like a cracked door lock: if someone sends the right kind of message, the service can be tricked into running operating-system commands on your server—using the highest privilege level (Windows SYSTEM).

This matters if your business uses Quest NetVault Backup and you have the NVBULogDaemon component running on a server that can be reached from the network. Based on the findings, the issue can be triggered remotely, and it can lead to code running with SYSTEM privileges.

Because the findings do not confirm the exact authentication requirement or the default reachability, treat it as a risk when the NVBULogDaemon JSON-RPC endpoint is reachable from outside your tightly controlled network (or reachable from untrusted internal networks).

This is AMBER because the vulnerability enables remote code execution with SYSTEM privileges, which can turn into complete compromise if the service is reachable. There is no public exploit code listed and CISA has not added it to its KEV catalog, so active exploitation is not confirmed.

Still, the risk is high-impact: if an attacker can reach the JSON-RPC processing, this is the kind of bug ransomware operators would target. Focus first on whether the affected service is exposed and whether any Quest remediation becomes available.