NETVAULT BACKUP · CVE-2026-13269 · Vendor
FIX → 14.1.3
Quest NetVault Backup has a numeric truncation error in its StnzCreateKey function that runs before a buffer is allocated. A remote attacker without credentials can trigger a denial-of-service condition on the backup server.
first public Nov 12, 2026 · 2 sources
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Teams that run Quest NetVault Backup server. An unauthenticated remote attacker who can reach the server over the network can crash the service (denial of service), which stops backups and restores. Not a code execution or data-theft issue per ZDI (availability only). Servers not reachable from untrusted networks are lower risk; still upgrade.
Not affected if netvault 14.1.3 or later
Who cares backup-server, netvault-backup, quest, self-hosted
14.1.3 should be treated as exposed, since Quest/ZDI publish no lower boundUpgrade to 14.1.3
Upgrade NetVault Backup to 14.1.3 or later (per ZDI-26-888; Quest release notes list Enhanced Denial-of-service protection NV-5190/NV-5191).
Quest NetVault Backup StnzCreateKey Numeric Truncation Error Denial-of-Service Vulnerability. This vulnerability allows remote attackers to create a denial-of-service condition on affected installations of Quest NetVault Backup. Authentication is not required to exploit this vulnerability.
The specific flaw exists within the StnzCreateKey function. The issue results from the lack of proper validation of user-supplied data, which can result in a numeric truncation error before allocating a buffer. An attacker can leverage this vulnerability to create a denial-of-service condition on the system. Was ZDI-CAN-28743.
This page as .md · .json · CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.