Riskcovery

CVE-2026-8654

State
Published
Severity
8.7 High
Published
May 15, 2026
Updated
May 15, 2026
Reserved
May 15, 2026

Read the record on cve.org

Description

Improper input validation in Delphix Continuous Data connectors allows an authenticated user to execute arbitrary operating system commands on the staging or target host.

Scores

CVSSScoreVectorSource
4.08.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:NPerforce

Weaknesses

  • CWE-78 Improper neutralization of special elements used in an OS command ('OS command injection')

Affected Products

ProductVersions
IBM Db2 ConnectorDelphix Continuous data
  • before 2025.2Affected
MangoDB ConnectorDelphix Continuous data
  • before 2025.2.1Affected
PostgreSQL ConnectorDelphix Continuous data
  • before 2025.1.0Affected
MySQL ConnectorDelphix Continuous data
  • before 2025.1.0Affected
Oracle EBS ConnectorDelphix Continuous data
  • before 2025.2.0Affected
SAP HANA ConnectorDelphix Continuous data
  • before 2026.2.0Affected
CockroachDB ConnectorDelphix Continuous data
  • before 2025.2.0Affected
Couchbase ConnectorDelphix Continuous data
  • before 1.3.2Affected
Cassandra ConnectorDelphix Continuous data
  • before 2025.1.0Affected
YugabyteDB ConnectorDelphix Continuous data
  • before 2025.1.1Affected
MSSQL on Linux ConnectorDelphix Continuous data
  • before 2025.1.0Affected
Oracle Backup Ingestion ConnectorDelphix Continuous data
  • before 4.2.1Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.