---
id: "CVE-2026-13270"
page: "https://infrastack.ai/live/CVE-2026-13270"
kind: "vulnerability"
aliases: ["CVE-2026-13270"]
title: "Quest NetVault Backup: nvpmgr integer underflow lets remote attackers crash service"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "vendor"
products: [{"name": "NetVault Backup", "fixed": ["14.1.3"], "affected": "< 14.1.3 (14.0.2.4 confirmed in CVE record)", "ecosystem": "vendor"}]
ecosystems: []
tags: ["linux", "quest-netvault-backup", "self-hosted", "vendor", "windows"]
not_affected_if: ["no-network-exposure", "udp-20031-blocked"]
published_at: "2026-11-12T03:17:11+00:00"
first_seen_at: "2026-11-12T03:46:13+00:00"
updated_at: "2026-11-12T03:48:37+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-13270", "first_seen_at": "2026-11-12T03:46:13+00:00"}, {"source": "analyst", "url": "https://www.zerodayinitiative.com/advisories/ZDI-26-889/", "first_seen_at": "2026-11-12T03:48:37+00:00", "cites": ["https://www.zerodayinitiative.com/advisories/ZDI-26-889/", "https://support.quest.com/technical-documents/netvault/14.1.3/release-notes/2"]}]
exploit_sources: []
---

# Quest NetVault Backup: nvpmgr integer underflow lets remote attackers crash service

Link for people: https://infrastack.ai/live/CVE-2026-13270 (this .md is for agents)

Quest NetVault Backup's nvpmgr service, listening on UDP port 20031 by default, mishandles user-supplied data and causes an integer underflow before a buffer allocation. A remote unauthenticated attacker can trigger a denial-of-service condition on the backup server.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:NetVault Backup affected < 14.1.3 (14.0.2.4 confirmed in CVE record) fixed 14.1.3

## How to check

- Check the installed NetVault version (WebUI > About, or the install's version file); versions before 14.1.3 should be treated as exposed (14.0.2.4 is the version named in the CVE record).
- Check whether UDP port 20031 (nvpmgr) is reachable from untrusted networks, e.g. from another host: nmap -sU -p 20031 <server>; restrict it to backup clients only.

## Fix

Upgrade NetVault Backup to 14.1.3 or later (per ZDI-26-889; Quest release notes list 'Enhanced Denial-of-service protection' NV-5190/NV-5191 in 14.1.3).

## Timeline

- 2026-11-12T03:46:13+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-13270
- 2026-11-12T03:48:37+00:00 analyst https://www.zerodayinitiative.com/advisories/ZDI-26-889/ — ZDI-26-889 says fixed in NetVault 14.1.3; Quest 14.1.3 release notes list only 'Enhanced DoS protection NV-5190/NV-5191' without naming the CVE, so fix not marked verified. NVD CNA lists affected 14.0.2.4 only; lower bound unknown.

## Documents

- [advisory] ZDI-26-889: Quest NetVault Backup nvpmgr Integer Underflow DoS https://www.zerodayinitiative.com/advisories/ZDI-26-889/
- [fix] NetVault 14.1.3 Release Notes https://support.quest.com/technical-documents/netvault/14.1.3/release-notes/2

## From the sources

Quest NetVault Backup nvpmgr Integer Underflow Denial-of-Service Vulnerability. This vulnerability allows remote attackers to create a denial-of-service condition on affected installations of Quest NetVault Backup. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the nvpmgr service, which listens on UDP port 20031 by default. The issue results from the lack of proper validation of user-supplied data, which can result in an integer underflow before allocating a buffer. An attacker can leverage this vulnerability to create a denial-of-service condition on the system. Was ZDI-CAN-28744.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_