Quest NetVault Backup Vulnerable to Denial-of-Service via Integer Underflow
A critical integer underflow vulnerability in Quest NetVault Backup's nvpmgr component allows unauthenticated remote attackers to cause a denial-of-service condition.
Quest NetVault Backup is facing scrutiny following the disclosure of a significant denial-of-service (DoS) vulnerability within its nvpmgr component. Identified as ZDI-26-889 and assigned CVE-2026-13270, this flaw permits unauthenticated remote attackers to disrupt the availability of vulnerable installations.
The vulnerability stems from an integer underflow condition that occurs due to a lack of proper validation of user-supplied data before buffer allocation. This specific weakness resides within the nvpmgr service, which by default listens on UDP port 20031. By manipulating the data sent to this service, an attacker can trigger the underflow, leading to a denial-of-service state and rendering the backup system inoperable.
The Common Vulnerability Scoring System (CVSS) has rated this vulnerability with a score of 7.5, classifying it as high severity. This indicates a substantial risk to organizations relying on Quest NetVault Backup for their data protection strategies. The ability for unauthenticated attackers to exploit this remotely exacerbates the threat, as it lowers the barrier to entry for malicious actors.
Quest has addressed this vulnerability by releasing NetVault version 14.1.3. Users are strongly advised to update to this latest version to mitigate the risk of exploitation. The release notes for version 14.1.3 provide further details on the fix and other improvements.
The disclosure timeline indicates that the vulnerability was initially reported to Quest on April 23, 2026. Following a coordinated public release, the advisory was updated on November 6, 2026, marking the official public awareness of the flaw. This timeline suggests a reasonable period for the vendor to develop and release a patch.
This incident highlights the ongoing challenges in securing backup and data protection solutions, which are often prime targets for attackers seeking to disrupt business operations or extort organizations. The unauthenticated nature of the exploit makes it particularly concerning, as it requires no prior access or credentials to initiate an attack.
Organizations utilizing Quest NetVault Backup should prioritize patching this vulnerability to prevent potential service disruptions. A thorough review of network configurations to ensure the nvpmgr service is not unnecessarily exposed to untrusted networks is also a prudent security measure. The high CVSS score and remote, unauthenticated exploitability underscore the urgency of this advisory.
The vulnerability, identified as CVE-2026-13269, specifically stems from a numeric truncation error within the StnzCreateKey function, distinct from the nvpmgr component mentioned previously. While both vulnerabilities allow for remote denial-of-service conditions without authentication, this new advisory provides the specific function and CVE ID, along with details on the underlying cause being improper validation leading to a truncation error before buffer allocation. The issue has been fixed in NetVault version 14.1.3.