CVE-2026-8654

Improper input validation in Delphix Continuous Data connectors allows an authenticated user to execute arbitrary operating system commands on the staging or target host.

CVSS

No CVSS.

References

Link	Resource
https://portal.perforce.com/s/cve/a91Qi000002z78HIAQ/authenticated-os-command-injection-in-delphix-continuous-data-connectors

Configurations

No configuration.

History

26 Oct 2026, 14:10

Type	Values Removed	Values Added
Summary		(es) Validación de entrada incorrecta en los conectores de Delphix Continuous Data permite a un usuario autenticado ejecutar comandos arbitrarios del sistema operativo en el host de staging o de destino.

Information

Published : 2026-05-15 07:16

Updated : 2026-10-26 14:10

NVD link : CVE-2026-8654

Mitre link : CVE-2026-8654

CVE.ORG link : CVE-2026-8654

JSON object : View

Products Affected

No product.

CWE

CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

{"id": "CVE-2026-8654", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-8654", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-05-15T11:09:19.072086Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "security@puppet.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.7, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security@puppet.com", "affectedData": [{"vendor": "Delphix Continuous data", "product": "IBM Db2 Connector", "versions": [{"status": "affected", "version": "0", "lessThan": "2025.2", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "Delphix Continuous data", "product": "MangoDB Connector", "versions": [{"status": "affected", "version": "0", "lessThan": "2025.2.1", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "Delphix Continuous data", "product": "PostgreSQL Connector", "versions": [{"status": "affected", "version": "0", "lessThan": "2025.1.0", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "Delphix Continuous data", "product": "MySQL Connector", "versions": [{"status": "affected", "version": "0", "lessThan": "2025.1.0", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "Delphix Continuous data", "product": "Oracle EBS Connector", "versions": [{"status": "affected", "version": "0", "lessThan": "2025.2.0", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "Delphix Continuous data", "product": "SAP HANA Connector", "versions": [{"status": "affected", "version": "0", "lessThan": "2026.2.0", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "Delphix Continuous data", "product": "CockroachDB Connector", "versions": [{"status": "affected", "version": "0", "lessThan": "2025.2.0", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "Delphix Continuous data", "product": "Couchbase Connector", "versions": [{"status": "affected", "version": "0", "lessThan": "1.3.2", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"vendor": "Delphix Continuous data", "product": "Cassandra Connector", "versions": [{"status": "affected", "version": "0", "lessThan": "2025.1.0", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "Delphix Continuous data", "product": "YugabyteDB Connector", "versions": [{"status": "affected", "version": "0", "lessThan": "2025.1.1", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "Delphix Continuous data", "product": "MSSQL on Linux Connector", "versions": [{"status": "affected", "version": "0", "lessThan": "2025.1.0", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "Delphix Continuous data", "product": "Oracle Backup Ingestion Connector", "versions": [{"status": "affected", "version": "0", "lessThan": "4.2.1", "versionType": "semver"}], "defaultStatus": "unaffected"}]}], "published": "2026-05-15T07:16:20.397", "references": [{"url": "https://portal.perforce.com/s/cve/a91Qi000002z78HIAQ/authenticated-os-command-injection-in-delphix-continuous-data-connectors", "source": "security@puppet.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "security@puppet.com", "description": [{"lang": "en", "value": "CWE-78"}]}], "descriptions": [{"lang": "en", "value": "Improper input validation in Delphix Continuous Data connectors allows an authenticated user to execute arbitrary operating system commands on the staging or target host."}, {"lang": "es", "value": "Validaci\u00f3n de entrada incorrecta en los conectores de Delphix Continuous Data permite a un usuario autenticado ejecutar comandos arbitrarios del sistema operativo en el host de staging o de destino."}], "lastModified": "2026-10-26T14:10:00.130", "sourceIdentifier": "security@puppet.com"}

CVE-2026-8654

JSON object

Attach tags to CVE-2026-8654

Attach tags to `CVE-2026-8654`