Quest NetVault Backup StnzCreateKey flaw enables unauthenticated remote DoS
Original title: ZDI-26-888: Quest NetVault Backup StnzCreateKey Numeric Truncation Error Denial-of-Service Vulnerability
ZDI-26-888 is a numeric truncation error, CVE-2026-13269, scored CVSS 7.5 with no fix named.
The Zero Day Initiative published ZDI-26-888, a numeric truncation error in StnzCreateKey on Quest NetVault Backup. Remote attackers can create a denial-of-service condition without authentication. ZDI assigned CVSS 7.5 and CVE-2026-13269. The notice does not list affected or fixed versions.
Unconfirmed: Affected versions and patch availability are not stated.
- The flaw is tracked as CVE-2026-13269 under advisory ZDI-26-888.
- ZDI assigned a CVSS rating of 7.5.
- No authentication is required to cause the denial of service.
Impact: unauthenticated remote denial of service
| Product | Affected |
|---|---|
| Quest NetVault Backup | — |
- CVEs
- CVE-2026-13269
- Vendors
- Quest
- Products
- NetVault Backup
- Organizations
- Zero Day Initiative
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-13269 | — | — | — |
From the original article
This vulnerability allows remote attackers to create a denial-of-service condition on affected installations of Quest NetVault Backup. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.
zerodayinitiative.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.