← Vulnerability feed

Vulnerability record · CVE-2019-18780 · published 5 November 2019

CVE-2019-18780: Veritas access command injection vulnerability

VVeritas · Access

An arbitrary command injection vulnerability in the Cluster Server component of Veritas InfoScale allows an unauthenticated remote attacker to execute arbitrary commands as root or administrator. These Veritas products are affected: Access 7.4.2 and earlier, Access Appliance 7.4.2 and earlier, Flex Appliance 1.2 and earlier, InfoScale 7.3.1 and earlier, InfoScale between 7.4.0 and 7.4.1, Veritas Cluster Server (VCS) 6.2.1 and earlier on Linux/UNIX, Veritas Cluster Server (VCS) 6.1 and earlier on Windows, Storage Foundation HA (SFHA) 6.2.1 and earlier on Linux/UNIX, and Storage Foundation HA (SFHA) 6.1 and earlier on Windows.

9.8 CVSS 3.1 Critical EPSS 6.1% · top 6.8% CWE-77 · Command injection
9.8CVSS 3.1 base score, v2 10.0
6.1%EPSS exploitation probability, 30 days
NoNot in CISA KEV
6Affected product versions listed by NVD
8References
17 Jun 2026Last modified by NVD

Description

An arbitrary command injection vulnerability in the Cluster Server component of Veritas InfoScale allows an unauthenticated remote attacker to execute arbitrary commands as root or administrator. These Veritas products are affected: Access 7.4.2 and earlier, Access Appliance 7.4.2 and earlier, Flex Appliance 1.2 and earlier, InfoScale 7.3.1 and earlier, InfoScale between 7.4.0 and 7.4.1, Veritas Cluster Server (VCS) 6.2.1 and earlier on Linux/UNIX, Veritas Cluster Server (VCS) 6.1 and earlier on Windows, Storage Foundation HA (SFHA) 6.2.1 and earlier on Linux/UNIX, and Storage Foundation HA (SFHA) 6.1 and earlier on Windows.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

6 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://www.veritas.com/content/support/en_US/security/VTS19-003 PatchVendor Advisory
https://www.veritas.com/content/support/en_US/security/VTS19-004 PatchVendor Advisory
https://www.veritas.com/content/support/en_US/security/VTS19-005 PatchVendor Advisory
https://www.veritas.com/content/support/en_US/security/VTS19-006 PatchVendor Advisory
https://www.veritas.com/content/support/en_US/security/VTS19-003 PatchVendor Advisory
https://www.veritas.com/content/support/en_US/security/VTS19-004 PatchVendor Advisory
https://www.veritas.com/content/support/en_US/security/VTS19-005 PatchVendor Advisory
https://www.veritas.com/content/support/en_US/security/VTS19-006 PatchVendor Advisory

Track CVE-2019-18780 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2022-22965Spring Framework data binding remote code execution (Spring4Shell)Spring MVC and Spring WebFlux applications on JDK 9+ can be exploited through data binding to achieve remote code execution. The known exploit path r…KEVEPSS 100%analysed9.8CVE-2022-46414Veritas access appliance missing authentication for critical function vulnerabilityAn issue was discovered in Veritas NetBackup Flex Scale through 3.0 and Access Appliance through 8.0.100. Unauthenticated remote command execution ca…EPSS 1.3%9.8CVE-2022-36986Veritas flex appliance vulnerabilityAn issue was discovered in Veritas NetBackup 8.1.x through 8.1.2, 8.2, 8.3.x through 8.3.0.2, 9.x through 9.0.0.1, and 9.1.x through 9.1.0.1 (and rel…EPSS 0.95%8.8CVE-2022-46411Veritas access appliance improper authentication vulnerabilityAn issue was discovered in Veritas NetBackup Flex Scale through 3.0 and Access Appliance through 8.0.100. A default password is persisted after insta…EPSS 0.58%8.8CVE-2022-46413Veritas access appliance vulnerabilityAn issue was discovered in Veritas NetBackup Flex Scale through 3.0 and Access Appliance through 8.0.100. Authenticated remote command execution can …EPSS 1.5%8.8CVE-2022-36993Veritas flex appliance vulnerabilityAn issue was discovered in Veritas NetBackup 8.1.x through 8.1.2, 8.2, 8.3.x through 8.3.0.2, 9.x through 9.0.0.1, and 9.1.x through 9.1.0.1 (and rel…EPSS 1.0%8.8CVE-2022-36997Veritas flex appliance server-side request forgery (ssrf) vulnerabilityAn issue was discovered in Veritas NetBackup 8.1.x through 8.1.2, 8.2, 8.3.x through 8.3.0.2, 9.x through 9.0.0.1, and 9.1.x through 9.1.0.1 (and rel…EPSS 0.70%8.8CVE-2022-36988Veritas flex appliance vulnerabilityAn issue was discovered in Veritas NetBackup 8.1.x through 8.1.2, 8.2, 8.3.x through 8.3.0.2, 9.x through 9.0.0.1, and 9.1.x through 9.1.0.1 (and rel…EPSS 0.89%

Source: NIST National Vulnerability Database (record CVE-2019-18780), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.