Skip to content
NewA calmer, faster ZeroHour
StoryVulnerabilitymedium

ZDI discloses two unauthenticated Quest NetVault Backup denial-of-service flaws

1 source · 3 articlesFirst reported Updated ()
What's new

First merged summary.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

ZDI published two Quest NetVault Backup remote denial-of-service advisories, both scored CVSS 7.5, with no fixes or versions named.

The Zero Day Initiative published two Quest NetVault Backup advisories on November 6, 2026. ZDI-26-889 describes an integer underflow in the nvpmgr component, tracked as CVE-2026-13270. ZDI-26-888 describes a numeric truncation error in StnzCreateKey, tracked as CVE-2026-13269. In both cases, ZDI says remote attackers can cause a denial of service without authentication and assigned CVSS 7.5. Neither notice states affected or fixed versions or an exploitation status.

Key facts
  • ZDI-26-889 tracks CVE-2026-13270, an integer underflow in nvpmgr.
  • ZDI-26-888 tracks CVE-2026-13269, a numeric truncation error in StnzCreateKey.
  • ZDI scored both flaws CVSS 7.5 and said authentication is not required.
  • Neither advisory names affected versions, a patch, or exploitation status.
Analyze CVE-2026-121614 with Vani AIImpact, affected versions, exploitation, mitigations and detection

Timeline

dated events in the reporting · oldest first
  1. Nov 6, 2026ZDI publishes two Quest NetVault Backup denial-of-service advisories. · ZDI Published Advisories

What each outlet adds

beyond the shared facts
  • ZDI Published AdvisoriesSeparates nvpmgr integer underflow from StnzCreateKey numeric truncation, both unauthenticated DoS.
CVEs
CVE-2026-121614CVE-2026-13270CVE-2026-13269
Vendors
DockerQuest
Products
Docker SandboxesNetVault Backup
Organizations
Zero Day Initiative

Coverage

oldest first · one row per article · UTC
  1. · 3d ago ZDI Published AdvisoriesFirst report

    Quest NetVault Backup nvpmgr flaw allows unauthenticated remote denial of service

    ZDI scores the integer underflow CVE-2026-13270 at 7.5 and does not name a fix.

  2. · 3d ago ZDI Published Advisories

    Docker Sandboxes flaw allows local code execution

    ZDI rates CVE-2026-121614 at CVSS 7.8; the user must open a malicious file or page.

  3. · 3d ago ZDI Published Advisories

    Quest NetVault Backup StnzCreateKey flaw enables unauthenticated remote DoS

    ZDI-26-888 is a numeric truncation error, CVE-2026-13269, scored CVSS 7.5 with no fix named.

Vulnerabilities in this story

All
CVEVulnerabilityCVSSEPSSSignalsPublished
CVE-2026-121614
External command execution via Git config in Docker Sandboxes before 0.50.0
7.1—
CVE-2026-13269
———
CVE-2026-13270
———