{"id":"CVE-2026-13269","kind":"vulnerability","aliases":["CVE-2026-13269"],"related":[],"title":"Quest NetVault Backup: unauthenticated remote crash via numeric truncation in StnzCreateKey","description":"Quest NetVault Backup StnzCreateKey Numeric Truncation Error Denial-of-Service Vulnerability. This vulnerability allows remote attackers to create a denial-of-service condition on affected installations of Quest NetVault Backup. Authentication is not required to exploit this vulnerability.\n\nThe specific flaw exists within the StnzCreateKey function. The issue results from the lack of proper validation of user-supplied data, which can result in a numeric truncation error before allocating a buffer. An attacker can leverage this vulnerability to create a denial-of-service condition on the system. Was ZDI-CAN-28743.","summary":"Quest NetVault Backup has a numeric truncation error in its StnzCreateKey function that runs before a buffer is allocated. A remote attacker without credentials can trigger a denial-of-service condition on the backup server.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"NetVault Backup","fixed":["14.1.3"],"affected":"< 14.1.3","ecosystem":"vendor"}],"ecosystems":[],"tags":["backup-server","netvault-backup","quest","self-hosted","vendor"],"not_affected_if":["netvault 14.1.3 or later"],"how_to_check":"Check the NetVault Server version in the WebUI (or installed package version); versions below 14.1.3 should be treated as exposed, since Quest/ZDI publish no lower bound. Also check whether the NetVault server's service ports are reachable from untrusted networks; no authentication is needed.","fix":"Upgrade NetVault Backup to 14.1.3 or later (per ZDI-26-888; Quest release notes list 'Enhanced Denial-of-service protection' NV-5190/NV-5191).","status":"open","published_at":"2026-11-12T03:17:11+00:00","first_seen_at":"2026-11-12T03:46:13+00:00","triaged_at":"2026-11-12T03:47:44+00:00","updated_at":"2026-11-12T03:48:35+00:00","category":"vendor","confidence":0.7,"triage":{"at":"2026-11-12T03:47:44Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Quest NetVault Backup: unauthenticated remote crash via numeric truncation in StnzCreateKey","impact":"low","summary":"Quest NetVault Backup has a numeric truncation error in its StnzCreateKey function that runs before a buffer is allocated. A remote attacker without credentials can trigger a denial-of-service condition on the backup server.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["netvault-backup","quest","backup-server"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Backup service crashes, denying service to the affected system","analyst_note":"Find affected and fixed NetVault Backup versions and the vendor advisory for CVE-2026-13269 (ZDI-CAN-28743).","how_to_check":"- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Organizations running Quest NetVault Backup servers that accept network connections are exposed, since authentication is not required to trigger the flaw. The sources do not state which versions are affected or whether default configurations are vulnerable. Teams that do not run NetVault Backup can skip it.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000701,"input_tokens":4665,"output_tokens":468,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find affected and fixed NetVault Backup versions and the vendor advisory for CVE-2026-13269 (ZDI-CAN-28743).","search":"'-13269':14A,17A '-2026':13A,16A '28743':162C 'affect':93C 'alloc':49B,138C 'allow':81C 'attack':52B,83C,142C 'authent':99C 'backup':3A,19A,21B,25B,33B,65B,69C,98C 'backup-serv':20B 'buffer':47B,140C 'condit':62B,91C,154C 'crash':6A 'creat':85C,148C 'credenti':54B 'cve':12A,15A 'data':128C 'denial':59B,75C,88C,151C 'denial-of-servic':58B,74C,87C,150C 'error':38B,73C,136C 'exist':110C 'exploit':104C 'flaw':109C 'function':42B,114C 'host':29B 'instal':94C 'issu':116C 'lack':120C 'leverag':144C 'netvault':2A,18A,24B,32B,68C,97C 'netvault-backup':23B 'numer':8A,36B,71C,134C 'proper':122C 'quest':1A,26B,31B,67C,96C 'remot':5A,51B,82C 'requir':102C 'result':117C,131C 'run':44B 'self':28B 'self-host':27B 'server':22B,66B 'servic':61B,77C,90C,153C 'specif':108C 'stnzcreatekey':11A,41B,70C,113C 'suppli':127C 'system':157C 'trigger':56B 'truncat':9A,37B,72C,135C 'unauthent':4A 'user':126C 'user-suppli':125C 'valid':123C 'vendor':30B 'via':7A 'vulner':78C,80C,106C,146C 'within':111C 'without':53B 'zdi':160C 'zdi-can':159C","nicknames":[],"mitigations":[],"who_affected":"Teams that run Quest NetVault Backup server. An unauthenticated remote attacker who can reach the server over the network can crash the service (denial of service), which stops backups and restores. Not a code execution or data-theft issue per ZDI (availability only). Servers not reachable from untrusted networks are lower risk; still upgrade.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["backup","netvaultbackup"],"ptokens":["backup","netvault"],"labels":["backupserver","high","netvaultbackup","quest","selfhosted","vendor"],"campaign_type":null,"search_a":"'-13269':14A,17A '-2026':13A,16A 'backup':3A,19A 'crash':6A 'cve':12A,15A 'netvault':2A,18A 'numer':8A 'quest':1A 'remot':5A 'stnzcreatekey':11A 'truncat':9A 'unauthent':4A 'via':7A","search_b":"'alloc':49B 'attack':52B 'backup':21B,25B,33B,65B 'backup-serv':20B 'buffer':47B 'condit':62B 'credenti':54B 'denial':59B 'denial-of-servic':58B 'error':38B 'function':42B 'host':29B 'netvault':24B,32B 'netvault-backup':23B 'numer':36B 'quest':26B,31B 'remot':51B 'run':44B 'self':28B 'self-host':27B 'server':22B,66B 'servic':61B 'stnzcreatekey':41B 'trigger':56B 'truncat':37B 'vendor':30B 'without':53B","search_c":"'28743':162C 'affect':93C 'alloc':138C 'allow':81C 'attack':83C,142C 'authent':99C 'backup':69C,98C 'buffer':140C 'condit':91C,154C 'creat':85C,148C 'data':128C 'denial':75C,88C,151C 'denial-of-servic':74C,87C,150C 'error':73C,136C 'exist':110C 'exploit':104C 'flaw':109C 'function':114C 'instal':94C 'issu':116C 'lack':120C 'leverag':144C 'netvault':68C,97C 'numer':71C,134C 'proper':122C 'quest':67C,96C 'remot':82C 'requir':102C 'result':117C,131C 'servic':77C,90C,153C 'specif':108C 'stnzcreatekey':70C,113C 'suppli':127C 'system':157C 'truncat':72C,135C 'user':126C 'user-suppli':125C 'valid':123C 'vulner':78C,80C,106C,146C 'within':111C 'zdi':160C 'zdi-can':159C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-12T03:17:11+00:00","kev":null,"cvss_vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvss_by":"zdi-disclosures@trendmicro.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-13269","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-13269","severity":null,"published_at":"2026-11-12T03:17:11+00:00","modified_at":"2026-11-12T03:17:11+00:00","first_seen_at":"2026-11-12T03:46:13+00:00","fetched_at":"2026-11-12T03:46:13+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-13269:3680","url":"https://www.zerodayinitiative.com/advisories/ZDI-26-888/","severity":null,"published_at":"2026-11-12T03:48:35+00:00","modified_at":"2026-11-12T03:48:35+00:00","first_seen_at":"2026-11-12T03:48:35+00:00","fetched_at":"2026-11-12T03:48:35+00:00","note":"ZDI-26-888 says fixed in NetVault 14.1.3; Quest 14.1.3 release notes list only 'Enhanced DoS protection' (NV-5190/5191) without naming the CVE, so fix not marked verified. Lower affected bound not published. No X/post search done; no exploitation or PoC seen.","cites":["https://www.zerodayinitiative.com/advisories/ZDI-26-888/","https://support.quest.com/technical-documents/netvault/14.1.3/release-notes/2"]}],"documents":[{"id":131528,"url":"https://www.zerodayinitiative.com/advisories/ZDI-26-888/","title":"ZDI-26-888: Quest NetVault Backup StnzCreateKey Numeric Truncation Error DoS","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":131530,"url":"https://support.quest.com/technical-documents/netvault/14.1.3/release-notes/2","title":"NetVault 14.1.3 Release Notes","kind":"release","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}