{"id":"CVE-2026-13270","kind":"vulnerability","aliases":["CVE-2026-13270"],"related":[],"title":"Quest NetVault Backup: nvpmgr integer underflow lets remote attackers crash service","description":"Quest NetVault Backup nvpmgr Integer Underflow Denial-of-Service Vulnerability. This vulnerability allows remote attackers to create a denial-of-service condition on affected installations of Quest NetVault Backup. Authentication is not required to exploit this vulnerability.\n\nThe specific flaw exists within the nvpmgr service, which listens on UDP port 20031 by default. The issue results from the lack of proper validation of user-supplied data, which can result in an integer underflow before allocating a buffer. An attacker can leverage this vulnerability to create a denial-of-service condition on the system. Was ZDI-CAN-28744.","summary":"Quest NetVault Backup's nvpmgr service, listening on UDP port 20031 by default, mishandles user-supplied data and causes an integer underflow before a buffer allocation. A remote unauthenticated attacker can trigger a denial-of-service condition on the backup server.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"NetVault Backup","fixed":["14.1.3"],"affected":"< 14.1.3 (14.0.2.4 confirmed in CVE record)","ecosystem":"vendor"}],"ecosystems":[],"tags":["linux","quest-netvault-backup","self-hosted","vendor","windows"],"not_affected_if":["no-network-exposure","udp-20031-blocked"],"how_to_check":"- Check the installed NetVault version (WebUI > About, or the install's version file); versions before 14.1.3 should be treated as exposed (14.0.2.4 is the version named in the CVE record).\n- Check whether UDP port 20031 (nvpmgr) is reachable from untrusted networks, e.g. from another host: nmap -sU -p 20031 <server>; restrict it to backup clients only.","fix":"Upgrade NetVault Backup to 14.1.3 or later (per ZDI-26-889; Quest release notes list 'Enhanced Denial-of-service protection' NV-5190/NV-5191 in 14.1.3).","status":"open","published_at":"2026-11-12T03:17:11+00:00","first_seen_at":"2026-11-12T03:46:13+00:00","triaged_at":"2026-11-12T03:47:45+00:00","updated_at":"2026-11-12T03:48:37+00:00","category":"vendor","confidence":0.75,"triage":{"at":"2026-11-12T03:47:45Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Quest NetVault Backup: nvpmgr integer underflow lets remote attackers crash service","impact":"low","summary":"Quest NetVault Backup's nvpmgr service, listening on UDP port 20031 by default, mishandles user-supplied data and causes an integer underflow before a buffer allocation. A remote unauthenticated attacker can trigger a denial-of-service condition on the backup server.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["quest-netvault-backup","self-hosted","windows","linux"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Remote attacker crashes the backup service with unauthenticated network traffic","analyst_note":"Find the affected version ranges and fixed version in the Quest advisory or NVD entry for CVE-2026-13270; confirm the platforms it runs on.","how_to_check":"- Check whether the nvpmgr service is reachable on UDP port `20031` from untrusted networks\n- Confirm the installed NetVault Backup version against the vendor advisory: unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["udp-20031-blocked","no-network-exposure"],"who_is_affected":"Any installation of Quest NetVault Backup where the nvpmgr service on UDP port 20031 can be reached over the network is exposed. Systems that block that UDP port from untrusted networks are less exposed. The sources do not list affected version ranges.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000759,"input_tokens":4666,"output_tokens":584,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the affected version ranges and fixed version in the Quest advisory or NVD entry for CVE-2026-13270; confirm the platforms it runs on.","search":"'-13270':14A,17A '-2026':13A,16A '20031':40B,125C '28744':174C 'affect':98C 'alloc':56B,150C 'allow':86C 'attack':9A,60B,88C,154C 'authent':104C 'backup':3A,19A,24B,32B,71B,75C,103C 'buffer':55B,152C 'caus':49B 'condit':68B,96C,166C 'crash':10A 'creat':90C,160C 'cve':12A,15A 'data':47B,141C 'default':42B,127C 'denial':65B,80C,93C,163C 'denial-of-servic':64B,79C,92C,162C 'exist':115C 'exploit':109C 'flaw':114C 'host':27B 'instal':99C 'integ':5A,51B,77C,147C 'issu':129C 'lack':133C 'let':7A 'leverag':156C 'linux':20B 'listen':36B,121C 'mishandl':43B 'netvault':2A,18A,23B,31B,74C,102C 'nvpmgr':4A,34B,76C,118C 'port':39B,124C 'proper':135C 'quest':1A,22B,30B,73C,101C 'quest-netvault-backup':21B 'remot':8A,58B,87C 'requir':107C 'result':130C,144C 'self':26B 'self-host':25B 'server':72B 'servic':11A,35B,67B,82C,95C,119C,165C 'specif':113C 'suppli':46B,140C 'system':169C 'trigger':62B 'udp':38B,123C 'unauthent':59B 'underflow':6A,52B,78C,148C 'user':45B,139C 'user-suppli':44B,138C 'valid':136C 'vendor':28B 'vulner':83C,85C,111C,158C 'window':29B 'within':116C 'zdi':172C 'zdi-can':171C","nicknames":[],"mitigations":[],"who_affected":"Teams running Quest NetVault Backup (server or client; Windows and Linux) at a version before 14.1.3 where the nvpmgr service on UDP 20031 can be reached over the network. No authentication is needed, and the effect is a crash/denial of service of the backup service, not code execution. Installations that keep UDP 20031 firewalled to trusted backup hosts, or already run 14.1.3+, can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["backup","netvaultbackup"],"ptokens":["backup","netvault"],"labels":["high","linux","questnetvaultbackup","selfhosted","vendor","windows"],"campaign_type":null,"search_a":"'-13270':14A,17A '-2026':13A,16A 'attack':9A 'backup':3A,19A 'crash':10A 'cve':12A,15A 'integ':5A 'let':7A 'netvault':2A,18A 'nvpmgr':4A 'quest':1A 'remot':8A 'servic':11A 'underflow':6A","search_b":"'20031':40B 'alloc':56B 'attack':60B 'backup':24B,32B,71B 'buffer':55B 'caus':49B 'condit':68B 'data':47B 'default':42B 'denial':65B 'denial-of-servic':64B 'host':27B 'integ':51B 'linux':20B 'listen':36B 'mishandl':43B 'netvault':23B,31B 'nvpmgr':34B 'port':39B 'quest':22B,30B 'quest-netvault-backup':21B 'remot':58B 'self':26B 'self-host':25B 'server':72B 'servic':35B,67B 'suppli':46B 'trigger':62B 'udp':38B 'unauthent':59B 'underflow':52B 'user':45B 'user-suppli':44B 'vendor':28B 'window':29B","search_c":"'20031':125C '28744':174C 'affect':98C 'alloc':150C 'allow':86C 'attack':88C,154C 'authent':104C 'backup':75C,103C 'buffer':152C 'condit':96C,166C 'creat':90C,160C 'data':141C 'default':127C 'denial':80C,93C,163C 'denial-of-servic':79C,92C,162C 'exist':115C 'exploit':109C 'flaw':114C 'instal':99C 'integ':77C,147C 'issu':129C 'lack':133C 'leverag':156C 'listen':121C 'netvault':74C,102C 'nvpmgr':76C,118C 'port':124C 'proper':135C 'quest':73C,101C 'remot':87C 'requir':107C 'result':130C,144C 'servic':82C,95C,119C,165C 'specif':113C 'suppli':140C 'system':169C 'udp':123C 'underflow':78C,148C 'user':139C 'user-suppli':138C 'valid':136C 'vulner':83C,85C,111C,158C 'within':116C 'zdi':172C 'zdi-can':171C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-12T03:17:11+00:00","kev":null,"cvss_vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvss_by":"zdi-disclosures@trendmicro.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-13270","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-13270","severity":null,"published_at":"2026-11-12T03:17:11+00:00","modified_at":"2026-11-12T03:17:11+00:00","first_seen_at":"2026-11-12T03:46:13+00:00","fetched_at":"2026-11-12T03:46:13+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-13270:3679","url":"https://www.zerodayinitiative.com/advisories/ZDI-26-889/","severity":null,"published_at":"2026-11-12T03:48:37+00:00","modified_at":"2026-11-12T03:48:37+00:00","first_seen_at":"2026-11-12T03:48:37+00:00","fetched_at":"2026-11-12T03:48:37+00:00","note":"ZDI-26-889 says fixed in NetVault 14.1.3; Quest 14.1.3 release notes list only 'Enhanced DoS protection NV-5190/NV-5191' without naming the CVE, so fix not marked verified. NVD CNA lists affected 14.0.2.4 only; lower bound unknown.","cites":["https://www.zerodayinitiative.com/advisories/ZDI-26-889/","https://support.quest.com/technical-documents/netvault/14.1.3/release-notes/2"]}],"documents":[{"id":131529,"url":"https://www.zerodayinitiative.com/advisories/ZDI-26-889/","title":"ZDI-26-889: Quest NetVault Backup nvpmgr Integer Underflow DoS","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":131530,"url":"https://support.quest.com/technical-documents/netvault/14.1.3/release-notes/2","title":"NetVault 14.1.3 Release Notes","kind":"release","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}