Denial-of-Service in Quest NetVault Backup (CVE‑2026‑13269) Enables Unauthenticated Remote Disruption
What It Is — Quest NetVault Backup contains a numeric truncation error in the StnzCreateKey function. The flaw occurs because user‑supplied data is not validated before a buffer allocation, allowing an attacker to trigger a numeric overflow that crashes the service. Exploitation requires no authentication, no user interaction, and can be performed over the network (AV:N, AC:L, PR:N, UI:N). The CVSS v3.1 base score is 7.5 (High), with the impact vector limited to availability (A:H). Quest released a fix in NetVault 14.1.3.
Affected Products — Quest NetVault Backup (all versions prior to 14.1.3).
Why It Matters for Trust & Control Assurance — The vulnerability tests the control objective of availability and resilient input validation. Demonstrating that you have validated input handling and timely patching satisfies a single VCF control that maps to many frameworks’ resilience requirements.
Recommended Actions —
- Confirm the deployed NetVault version; upgrade immediately to 14.1.3 or later.
- Deploy continuous monitoring for service‑availability anomalies to detect potential DoS attempts.
- Record the remediation steps and patch evidence in your control‑evidence repository for audit readiness.
Source: Zero Day Initiative advisory