Integer Underflow in Quest NetVault Backup (CVE‑2026‑13270) Enables Unauthenticated Denial‑of‑Service
What It Is — The nvpmgr service in Quest NetVault Backup fails to validate user‑supplied data received on UDP 20031. An integer underflow can be triggered, causing a buffer‑allocation error that crashes the service. Because the service is reachable without authentication, a remote attacker can flood the UDP port with crafted packets and render the backup appliance unavailable. The flaw is tracked as CVE‑2026‑13270, carries a CVSS 7.5 (High) score (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), and was publicly disclosed on 6 Nov 2026. Quest released a fix in NetVault 14.1.3.
Affected Products — Quest NetVault Backup (all versions prior to 14.1.3).
Why It Matters for Trust & Control Assurance — This issue tests the control objective of maintaining availability and continuous monitoring of critical services; proving you can detect, patch, and evidence remediation is essential for audit readiness.
Recommended Actions
- Upgrade NetVault to version 14.1.3 or later.
- Restrict inbound traffic to UDP 20031 via firewall or network segmentation.
- Verify remediation in your asset inventory and capture patch‑application evidence.
- Incorporate the service‑availability control into your continuous monitoring program.