Vulnerability details
CVE-2026-8654
Delphix Continuous data Cassandra ConnectorDelphix Continuous data CockroachDB ConnectorDelphix Continuous data Couchbase ConnectorDelphix Continuous data IBM Db2 ConnectorDelphix Continuous data MSSQL on Linux ConnectorDelphix Continuous data MangoDB Connector
CVSS 4.0
8.7High
Official description
Improper input validation in Delphix Continuous Data connectors allows an authenticated user to execute arbitrary operating system commands on the staging or target host.
CVSS scores
| Score | Version | Source | Vector |
|---|---|---|---|
| 8.7High | 4.0 | CVEProject cvelistV5 (CNA) (Perforce) | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N |
Affected products
| Vendor | Product | Versions | Source |
|---|---|---|---|
| Delphix Continuous data | Cassandra Connector | v < 2025.1.0 | CVEProject cvelistV5 (CNA) |
| Delphix Continuous data | CockroachDB Connector | v < 2025.2.0 | CVEProject cvelistV5 (CNA) |
| Delphix Continuous data | Couchbase Connector | v < 1.3.2 | CVEProject cvelistV5 (CNA) |
| Delphix Continuous data | IBM Db2 Connector | v < 2025.2 | CVEProject cvelistV5 (CNA) |
| Delphix Continuous data | MSSQL on Linux Connector | v < 2025.1.0 | CVEProject cvelistV5 (CNA) |
| Delphix Continuous data | MangoDB Connector | v < 2025.2.1 | CVEProject cvelistV5 (CNA) |
| Delphix Continuous data | MySQL Connector | v < 2025.1.0 | CVEProject cvelistV5 (CNA) |
| Delphix Continuous data | Oracle Backup Ingestion Connector | v < 4.2.1 | CVEProject cvelistV5 (CNA) |
| Delphix Continuous data | Oracle EBS Connector | v < 2025.2.0 | CVEProject cvelistV5 (CNA) |
| Delphix Continuous data | PostgreSQL Connector | v < 2025.1.0 | CVEProject cvelistV5 (CNA) |
| Delphix Continuous data | SAP HANA Connector | v < 2026.2.0 | CVEProject cvelistV5 (CNA) |
| Delphix Continuous data | YugabyteDB Connector | v < 2025.1.1 | CVEProject cvelistV5 (CNA) |
References and advisories
1
Kolun on Telegram @kolunsec
Exploited CVEs, key news and a daily digest
Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.
Details
- Published
- 2026-05-15
- Last updated
- 2026-05-15
- State
- Published
- Assigner (CNA)
- Perforce
Exploit prediction (EPSS)
0.23%
Probability of exploitation in 30 days
14.3%
Percentile (among all CVEs)
SSVC assessment (CISA)
- Automatable
- No
- Exploitation
- None
- Technical impact
- Total
Weaknesses (CWE)
- CWE-78Improper neutralization of special elements used in an OS command ('OS command injection')