CVE-2019-7850
CVE-2019-7850 is a critical-severity vulnerability in Adobe Campaign with a CVSS 3.x base score of 9.8. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-77.
Key facts
- Severity: Critical (CVSS 3.x base score 9.8)
- CVSS v2: 7.5
- EPSS exploit prediction: 6% (92nd percentile)
- Actively exploited: Not listed in CISA KEV
- Weakness: CWE-77
- Affected product: Adobe Campaign
- Published:
- Last modified:
Description
Adobe Campaign Classic version 18.10.5-8984 and earlier versions have a Command injection vulnerability. Successful exploitation could lead to Arbitrary Code Execution in the context of the current user.
Frequently asked questions
- What is CVE-2019-7850?
- Adobe Campaign Classic version 18.10.5-8984 and earlier versions have a Command injection vulnerability. Successful exploitation could lead to Arbitrary Code Execution in the context of the current user.
- How severe is CVE-2019-7850?
- CVE-2019-7850 has a CVSS 3.x base score of 9.8, rated critical severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.
- Is CVE-2019-7850 being actively exploited?
- It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 6% (92nd percentile), an estimate of the probability of exploitation in the next 30 days.
- What products are affected by CVE-2019-7850?
- CVE-2019-7850 affects Adobe Campaign. See the affected-products list for the exact vulnerable versions.
- How do I fix CVE-2019-7850?
- Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.
- When was CVE-2019-7850 published?
- CVE-2019-7850 was published on 2019-07-18 and last updated on 2026-06-17.
References
Affected products (1)
- cpe:2.3:a:adobe:campaign:*:*:*:*:classic:*:*:*
More vulnerabilities in Adobe Campaign
- CVE-2026-48286 — Critical (CVSS 10.0): Adobe Campaign Classic (ACC) versions 7.4.3 build 9396 and earlier are affected by an Incorrect Authorization…
- CVE-2026-48303 — Critical (CVSS 10.0): Adobe Campaign Classic (ACC) versions 7.4.3 build 9394 and earlier are affected by an Incorrect Authorization…
- CVE-2017-2989 — Critical (CVSS 9.1): Adobe Campaign versions Build 8770 and earlier have an input validation bypass that could be exploited to read, write,…
- CVE-2017-2968 — Critical (CVSS 9.1): Adobe Campaign versions 16.4 Build 8724 and earlier have a code injection vulnerability.
- CVE-2021-40745 — High (CVSS 7.5): Adobe Campaign version 21.2.1 (and earlier) is affected by a Path Traversal vulnerability that could lead to reading…
- CVE-2019-7941 — High (CVSS 7.5): Adobe Campaign Classic version 18.10.5-8984 and earlier versions have an Information Exposure Through an Error Message…
All CVEs affecting Adobe Campaign →
Other CWE-77 (Command Injection) vulnerabilities
- CVE-2026-23652 — Critical (CVSS 10.0): Improper neutralization of special elements used in a command ('command injection') in Microsoft Power Pages allows an…
- CVE-2025-59818 — Critical (CVSS 10.0): This vulnerability allows authenticated attackers to execute arbitrary commands on the underlying system using the file…
- CVE-2025-64093 — Critical (CVSS 10.0): Remote Code Execution vulnerability that allows unauthenticated attackers to inject arbitrary commands into the…
- CVE-2025-64090 — Critical (CVSS 10.0): This vulnerability allows authenticated attackers to execute commands via the hostname of the device.
- CVE-2025-61492 — Critical (CVSS 10.0): A command injection vulnerability in the execute_command function of terminal-controller-mcp 0.1.7 allows attackers to…
- CVE-2025-10035 — Critical (CVSS 10.0): A deserialization vulnerability in the License Servlet of Fortra's GoAnywhere MFT allows an actor with a validly forged…