{"id":"CVE-2026-8654","state":"PUBLISHED","title":"Improper input validation in Delphix Continuous Data connectors allows an authenticated user to execute arbitrary operating system commands on the staging or target host.","description":"Improper input validation in Delphix Continuous Data connectors allows an authenticated user to execute arbitrary operating system commands on the staging or target host.","publishedAt":"2026-05-15T05:59:25.449Z","updatedAt":"2026-05-15T11:09:43.904Z","severity":{"score":8.7,"label":"High","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","source":"Perforce"},"assigner":"Perforce","products":["Delphix Continuous data IBM Db2 Connector","Delphix Continuous data MangoDB Connector","Delphix Continuous data PostgreSQL Connector","Delphix Continuous data MySQL Connector","Delphix Continuous data Oracle EBS Connector","Delphix Continuous data SAP HANA Connector","Delphix Continuous data CockroachDB Connector","Delphix Continuous data Couchbase Connector","Delphix Continuous data Cassandra Connector","Delphix Continuous data YugabyteDB Connector","Delphix Continuous data MSSQL on Linux Connector","Delphix Continuous data Oracle Backup Ingestion Connector"],"affected":[{"vendor":"Delphix Continuous data","product":"IBM Db2 Connector","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"2025.2","versionType":"custom"}]},{"vendor":"Delphix Continuous data","product":"MangoDB Connector","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"2025.2.1","versionType":"custom"}]},{"vendor":"Delphix Continuous data","product":"PostgreSQL Connector","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"2025.1.0","versionType":"custom"}]},{"vendor":"Delphix Continuous data","product":"MySQL Connector","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"2025.1.0","versionType":"custom"}]},{"vendor":"Delphix Continuous data","product":"Oracle EBS Connector","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"2025.2.0","versionType":"custom"}]},{"vendor":"Delphix Continuous data","product":"SAP HANA Connector","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"2026.2.0","versionType":"custom"}]},{"vendor":"Delphix Continuous data","product":"CockroachDB Connector","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"2025.2.0","versionType":"custom"}]},{"vendor":"Delphix Continuous data","product":"Couchbase Connector","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"1.3.2","versionType":"semver"}]},{"vendor":"Delphix Continuous data","product":"Cassandra Connector","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"2025.1.0","versionType":"custom"}]},{"vendor":"Delphix Continuous data","product":"YugabyteDB Connector","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"2025.1.1","versionType":"custom"}]},{"vendor":"Delphix Continuous data","product":"MSSQL on Linux Connector","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"2025.1.0","versionType":"custom"}]},{"vendor":"Delphix Continuous data","product":"Oracle Backup Ingestion Connector","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"4.2.1","versionType":"semver"}]}],"references":["https://portal.perforce.com/s/cve/a91Qi000002z78HIAQ/authenticated-os-command-injection-in-delphix-continuous-data-connectors"],"weaknesses":["CWE-78"],"ingestedAt":"2026-10-29T20:13:26.108Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/8xxx/CVE-2026-8654.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-8654","state":"PUBLISHED","datePublished":"2026-05-15T05:59:25.449Z","dateUpdated":"2026-05-15T11:09:43.904Z","assignerShortName":"Perforce","assignerOrgId":"ca2a266c-be2f-4d4b-92d0-47b76b1a9c4e","dateReserved":"2026-05-15T05:14:12.757Z"},"containers":{"cna":{"descriptions":[{"lang":"en","value":"Improper input validation in Delphix Continuous Data connectors allows an authenticated user to execute arbitrary operating system commands on the staging or target host."}],"affected":[{"vendor":"Delphix Continuous data","product":"IBM Db2 Connector","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"2025.2","versionType":"custom"}]},{"vendor":"Delphix Continuous data","product":"MangoDB Connector","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"2025.2.1","versionType":"custom"}]},{"vendor":"Delphix Continuous data","product":"PostgreSQL Connector","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"2025.1.0","versionType":"custom"}]},{"vendor":"Delphix Continuous data","product":"MySQL Connector","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"2025.1.0","versionType":"custom"}]},{"vendor":"Delphix Continuous data","product":"Oracle EBS Connector","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"2025.2.0","versionType":"custom"}]},{"vendor":"Delphix Continuous data","product":"SAP HANA Connector","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"2026.2.0","versionType":"custom"}]},{"vendor":"Delphix Continuous data","product":"CockroachDB Connector","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"2025.2.0","versionType":"custom"}]},{"vendor":"Delphix Continuous data","product":"Couchbase Connector","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"1.3.2","versionType":"semver"}]},{"vendor":"Delphix Continuous data","product":"Cassandra Connector","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"2025.1.0","versionType":"custom"}]},{"vendor":"Delphix Continuous data","product":"YugabyteDB Connector","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"2025.1.1","versionType":"custom"}]},{"vendor":"Delphix Continuous data","product":"MSSQL on Linux Connector","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"2025.1.0","versionType":"custom"}]},{"vendor":"Delphix Continuous data","product":"Oracle Backup Ingestion Connector","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"4.2.1","versionType":"semver"}]}],"references":[{"url":"https://portal.perforce.com/s/cve/a91Qi000002z78HIAQ/authenticated-os-command-injection-in-delphix-continuous-data-connectors","tags":["vendor-advisory"]}],"metrics":[{"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}],"cvssV4_0":{"attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","subIntegrityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","version":"4.0","baseSeverity":"HIGH","baseScore":8.7,"vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-78","lang":"en","description":"CWE-78 Improper neutralization of special elements used in an OS command ('OS command injection')","type":"CWE"}]}],"providerMetadata":{"shortName":"Perforce","orgId":"ca2a266c-be2f-4d4b-92d0-47b76b1a9c4e","dateUpdated":"2026-05-15T06:14:00.862Z"},"impacts":[{"capecId":"CAPEC-88","descriptions":[{"lang":"en","value":"CAPEC-88 OS Command Injection"}]}],"cpeApplicability":[{"operator":"OR","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:delphix_continuous_data:ibm_db2_connector:*:*:*:*:*:*:*:*","versionStartIncluding":"0","versionEndExcluding":"2025.2"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:delphix_continuous_data:mangodb_connector:*:*:*:*:*:*:*:*","versionStartIncluding":"0","versionEndExcluding":"2025.2.1"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:delphix_continuous_data:postgresql_connector:*:*:*:*:*:*:*:*","versionStartIncluding":"0","versionEndExcluding":"2025.1.0"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:delphix_continuous_data:mysql_connector:*:*:*:*:*:*:*:*","versionStartIncluding":"0","versionEndExcluding":"2025.1.0"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:delphix_continuous_data:oracle_ebs_connector:*:*:*:*:*:*:*:*","versionStartIncluding":"0","versionEndExcluding":"2025.2.0"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:delphix_continuous_data:sap_hana_connector:*:*:*:*:*:*:*:*","versionStartIncluding":"0","versionEndExcluding":"2026.2.0"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:delphix_continuous_data:cockroachdb_connector:*:*:*:*:*:*:*:*","versionStartIncluding":"0","versionEndExcluding":"2025.2.0"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:delphix_continuous_data:couchbase_connector:*:*:*:*:*:*:*:*","versionStartIncluding":"0","versionEndExcluding":"1.3.2"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:delphix_continuous_data:cassandra_connector:*:*:*:*:*:*:*:*","versionStartIncluding":"0","versionEndExcluding":"2025.1.0"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:delphix_continuous_data:yugabytedb_connector:*:*:*:*:*:*:*:*","versionStartIncluding":"0","versionEndExcluding":"2025.1.1"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:delphix_continuous_data:mssql_on_linux_connector:*:*:*:*:*:*:*:*","versionStartIncluding":"0","versionEndExcluding":"2025.1.0"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:delphix_continuous_data:oracle_backup_ingestion_connector:*:*:*:*:*:*:*:*","versionStartIncluding":"0","versionEndExcluding":"4.2.1"}]}]}],"source":{"discovery":"UNKNOWN"},"x_generator":{"engine":"Vulnogram 1.0.2"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-05-15T11:09:19.072086Z","id":"CVE-2026-8654","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-05-15T11:09:43.904Z"}}]}}}