CVE-2026-8654
Full vulnerability record from the local CVENow database.
Description
Improper input validation in Delphix Continuous Data connectors allows an authenticated user to execute arbitrary operating system commands on the staging or target host.
Severity
HIGH
CVSS score
8.7
(v4.0)
Vulnerability status
Awaiting Analysis
Source identifier
Published
2026-05-15 07:16:20.397000
Last modified
2026-10-26 14:10:00.130000
View original CVE JSON
{
"id": "CVE-2026-8654",
"sourceIdentifier": "[email protected]",
"published": "2026-05-15T07:16:20.397",
"lastModified": "2026-10-26T14:10:00.130",
"vulnStatus": "Awaiting Analysis",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Improper input validation in Delphix Continuous Data connectors allows an authenticated user to execute arbitrary operating system commands on the staging or target host."
},
{
"lang": "es",
"value": "Validación de entrada incorrecta en los conectores de Delphix Continuous Data permite a un usuario autenticado ejecutar comandos arbitrarios del sistema operativo en el host de staging o de destino."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "Delphix Continuous data",
"product": "IBM Db2 Connector",
"defaultStatus": "unaffected",
"versions": [
{
"version": "0",
"lessThan": "2025.2",
"versionType": "custom",
"status": "affected"
}
]
},
{
"vendor": "Delphix Continuous data",
"product": "MangoDB Connector",
"defaultStatus": "unaffected",
"versions": [
{
"version": "0",
"lessThan": "2025.2.1",
"versionType": "custom",
"status": "affected"
}
]
},
{
"vendor": "Delphix Continuous data",
"product": "PostgreSQL Connector",
"defaultStatus": "unaffected",
"versions": [
{
"version": "0",
"lessThan": "2025.1.0",
"versionType": "custom",
"status": "affected"
}
]
},
{
"vendor": "Delphix Continuous data",
"product": "MySQL Connector",
"defaultStatus": "unaffected",
"versions": [
{
"version": "0",
"lessThan": "2025.1.0",
"versionType": "custom",
"status": "affected"
}
]
},
{
"vendor": "Delphix Continuous data",
"product": "Oracle EBS Connector",
"defaultStatus": "unaffected",
"versions": [
{
"version": "0",
"lessThan": "2025.2.0",
"versionType": "custom",
"status": "affected"
}
]
},
{
"vendor": "Delphix Continuous data",
"product": "SAP HANA Connector",
"defaultStatus": "unaffected",
"versions": [
{
"version": "0",
"lessThan": "2026.2.0",
"versionType": "custom",
"status": "affected"
}
]
},
{
"vendor": "Delphix Continuous data",
"product": "CockroachDB Connector",
"defaultStatus": "unaffected",
"versions": [
{
"version": "0",
"lessThan": "2025.2.0",
"versionType": "custom",
"status": "affected"
}
]
},
{
"vendor": "Delphix Continuous data",
"product": "Couchbase Connector",
"defaultStatus": "unaffected",
"versions": [
{
"version": "0",
"lessThan": "1.3.2",
"versionType": "semver",
"status": "affected"
}
]
},
{
"vendor": "Delphix Continuous data",
"product": "Cassandra Connector",
"defaultStatus": "unaffected",
"versions": [
{
"version": "0",
"lessThan": "2025.1.0",
"versionType": "custom",
"status": "affected"
}
]
},
{
"vendor": "Delphix Continuous data",
"product": "YugabyteDB Connector",
"defaultStatus": "unaffected",
"versions": [
{
"version": "0",
"lessThan": "2025.1.1",
"versionType": "custom",
"status": "affected"
}
]
},
{
"vendor": "Delphix Continuous data",
"product": "MSSQL on Linux Connector",
"defaultStatus": "unaffected",
"versions": [
{
"version": "0",
"lessThan": "2025.1.0",
"versionType": "custom",
"status": "affected"
}
]
},
{
"vendor": "Delphix Continuous data",
"product": "Oracle Backup Ingestion Connector",
"defaultStatus": "unaffected",
"versions": [
{
"version": "0",
"lessThan": "4.2.1",
"versionType": "semver",
"status": "affected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV40": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE",
"exploitMaturity": "NOT_DEFINED",
"confidentialityRequirement": "NOT_DEFINED",
"integrityRequirement": "NOT_DEFINED",
"availabilityRequirement": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"modifiedVulnConfidentialityImpact": "NOT_DEFINED",
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
"modifiedSubIntegrityImpact": "NOT_DEFINED",
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"valueDensity": "NOT_DEFINED",
"vulnerabilityResponseEffort": "NOT_DEFINED",
"providerUrgency": "NOT_DEFINED"
}
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-05-15T11:09:19.072086Z",
"id": "CVE-2026-8654",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "total"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-78"
}
]
}
],
"references": [
{
"url": "https://portal.perforce.com/s/cve/a91Qi000002z78HIAQ/authenticated-os-command-injection-in-delphix-continuous-data-connectors",
"source": "[email protected]"
}
]
}