CVE-2026-8654

Severity: high (CVSS 8.7 v4.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-05-15 · updated 2026-10-26
Weakness: CWE-78

Description

Improper input validation in Delphix Continuous Data connectors allows an authenticated user to execute arbitrary operating system commands on the staging or target host.

Affected products

Delphix Continuous data Cassandra Connector: before 2025.1.0 — fixed in 2025.1.0
Delphix Continuous data CockroachDB Connector: before 2025.2.0 — fixed in 2025.2.0
Delphix Continuous data Couchbase Connector: before 1.3.2 — fixed in 1.3.2
Delphix Continuous data IBM Db2 Connector: before 2025.2 — fixed in 2025.2
Delphix Continuous data MangoDB Connector: before 2025.2.1 — fixed in 2025.2.1
Delphix Continuous data MSSQL on Linux Connector: before 2025.1.0 — fixed in 2025.1.0
Delphix Continuous data MySQL Connector: before 2025.1.0 — fixed in 2025.1.0
Delphix Continuous data Oracle Backup Ingestion Connector: before 4.2.1 — fixed in 4.2.1
Delphix Continuous data Oracle EBS Connector: before 2025.2.0 — fixed in 2025.2.0
Delphix Continuous data PostgreSQL Connector: before 2025.1.0 — fixed in 2025.1.0
Delphix Continuous data SAP HANA Connector: before 2026.2.0 — fixed in 2026.2.0
Delphix Continuous data YugabyteDB Connector: before 2025.1.1 — fixed in 2025.1.1

How to fix

Upgrade to a fixed version: Delphix Continuous data Cassandra Connector 2025.1.0; Delphix Continuous data CockroachDB Connector 2025.2.0; Delphix Continuous data Couchbase Connector 1.3.2; Delphix Continuous data IBM Db2 Connector 2025.2; Delphix Continuous data MangoDB Connector 2025.2.1; Delphix Continuous data MSSQL on Linux Connector 2025.1.0; Delphix Continuous data MySQL Connector 2025.1.0; Delphix Continuous data Oracle Backup Ingestion Connector 4.2.1; Delphix Continuous data Oracle EBS Connector 2025.2.0; Delphix Continuous data PostgreSQL Connector 2025.1.0; Delphix Continuous data SAP HANA Connector 2026.2.0; Delphix Continuous data YugabyteDB Connector 2025.1.1. Check the vendor advisory for mitigations.

References

https://portal.perforce.com/s/cve/a91Qi000002z78HIAQ/authenticated-os-command-injection-in-delphix-continuous-data-connectors

Get alerted when CVE-2026-8654 or the next vulnerability affects your stack