---
id: "CVE-2026-13269"
page: "https://infrastack.ai/live/CVE-2026-13269"
kind: "vulnerability"
aliases: ["CVE-2026-13269"]
title: "Quest NetVault Backup: unauthenticated remote crash via numeric truncation in StnzCreateKey"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "vendor"
products: [{"name": "NetVault Backup", "fixed": ["14.1.3"], "affected": "< 14.1.3", "ecosystem": "vendor"}]
ecosystems: []
tags: ["backup-server", "netvault-backup", "quest", "self-hosted", "vendor"]
not_affected_if: ["netvault 14.1.3 or later"]
published_at: "2026-11-12T03:17:11+00:00"
first_seen_at: "2026-11-12T03:46:13+00:00"
updated_at: "2026-11-12T03:48:35+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-13269", "first_seen_at": "2026-11-12T03:46:13+00:00"}, {"source": "analyst", "url": "https://www.zerodayinitiative.com/advisories/ZDI-26-888/", "first_seen_at": "2026-11-12T03:48:35+00:00", "cites": ["https://www.zerodayinitiative.com/advisories/ZDI-26-888/", "https://support.quest.com/technical-documents/netvault/14.1.3/release-notes/2"]}]
exploit_sources: []
---

# Quest NetVault Backup: unauthenticated remote crash via numeric truncation in StnzCreateKey

Link for people: https://infrastack.ai/live/CVE-2026-13269 (this .md is for agents)

Quest NetVault Backup has a numeric truncation error in its StnzCreateKey function that runs before a buffer is allocated. A remote attacker without credentials can trigger a denial-of-service condition on the backup server.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:NetVault Backup affected < 14.1.3 fixed 14.1.3

## How to check

Check the NetVault Server version in the WebUI (or installed package version); versions below 14.1.3 should be treated as exposed, since Quest/ZDI publish no lower bound. Also check whether the NetVault server's service ports are reachable from untrusted networks; no authentication is needed.

## Fix

Upgrade NetVault Backup to 14.1.3 or later (per ZDI-26-888; Quest release notes list 'Enhanced Denial-of-service protection' NV-5190/NV-5191).

## Timeline

- 2026-11-12T03:46:13+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-13269
- 2026-11-12T03:48:35+00:00 analyst https://www.zerodayinitiative.com/advisories/ZDI-26-888/ — ZDI-26-888 says fixed in NetVault 14.1.3; Quest 14.1.3 release notes list only 'Enhanced DoS protection' (NV-5190/5191) without naming the CVE, so fix not marked verified. Lower affected bound not published. No X/post search done; no exploitation or PoC seen.

## Documents

- [advisory] ZDI-26-888: Quest NetVault Backup StnzCreateKey Numeric Truncation Error DoS https://www.zerodayinitiative.com/advisories/ZDI-26-888/
- [fix] NetVault 14.1.3 Release Notes https://support.quest.com/technical-documents/netvault/14.1.3/release-notes/2

## From the sources

Quest NetVault Backup StnzCreateKey Numeric Truncation Error Denial-of-Service Vulnerability. This vulnerability allows remote attackers to create a denial-of-service condition on affected installations of Quest NetVault Backup. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the StnzCreateKey function. The issue results from the lack of proper validation of user-supplied data, which can result in a numeric truncation error before allocating a buffer. An attacker can leverage this vulnerability to create a denial-of-service condition on the system. Was ZDI-CAN-28743.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_