ZDI discloses two unauthenticated Quest NetVault Backup DoS flaws
What's new
First merged summary.
Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI
ZDI published two unauthenticated Quest NetVault Backup denial-of-service flaws, both scored 7.5, with no fixes named.
The Zero Day Initiative published two Quest NetVault Backup advisories on November 6, 2026. ZDI-26-889 describes an integer underflow in nvpmgr tracked as CVE-2026-13270. ZDI-26-888 describes a numeric truncation error in StnzCreateKey tracked as CVE-2026-13269. Both allow remote unauthenticated denial of service and are scored CVSS 7.5. Neither notice states affected versions or a patch.
Key facts
- ZDI-26-889 tracks integer underflow CVE-2026-13270 in nvpmgr.
- ZDI-26-888 tracks numeric truncation CVE-2026-13269 in StnzCreateKey.
- Both flaws are scored CVSS 7.5 and need no authentication.
- Affected and fixed versions are not stated.
Timeline
dated events in the reporting · oldest first- Nov 6, 2026ZDI publishes two Quest NetVault Backup DoS advisories · ZDI Published Advisories
What each outlet adds
beyond the shared facts- ZDI Published AdvisoriesNames both components, CVEs, scores, and missing fix details.
- Vendors
- Quest
- Products
- NetVault Backup
- Organizations
- Zero Day Initiative
Coverage
oldest first · one row per article · UTC- · 5d ago
ZDI Published AdvisoriesFirst report
Quest NetVault Backup nvpmgr flaw allows unauthenticated remote denial of service
ZDI scores the integer underflow CVE-2026-13270 at 7.5 and does not name a fix.
- · 5d ago
Quest NetVault Backup StnzCreateKey flaw enables unauthenticated remote DoS
ZDI-26-888 is a numeric truncation error, CVE-2026-13269, scored CVSS 7.5 with no fix named.
Vulnerabilities in this story
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-13269 | — | — | — | ||
| CVE-2026-13270 | — | — | — |