Vulnerability · Published May 15, 2026 · Assigned by Perforce
CVE-2026-8654
High 8.7
In plain English
A high-severity OS command injection in Cassandra Connector from Delphix Continuous data. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 14% of all known vulnerabilities).
Severity (CVSS 4.0)8.7High
Exploit odds (30 days)0.2%top 85.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Improper input validation in Delphix Continuous Data connectors allows an authenticated user to execute arbitrary operating system commands on the staging or target host.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Delphix Continuous data | IBM Db2 Connector | 0 – before 2025.2 |
| Delphix Continuous data | MangoDB Connector | 0 – before 2025.2.1 |
| Delphix Continuous data | PostgreSQL Connector | 0 – before 2025.1.0 |
| Delphix Continuous data | MySQL Connector | 0 – before 2025.1.0 |
| Delphix Continuous data | Oracle EBS Connector | 0 – before 2025.2.0 |
| Delphix Continuous data | SAP HANA Connector | 0 – before 2026.2.0 |
| Delphix Continuous data | CockroachDB Connector | 0 – before 2025.2.0 |
| Delphix Continuous data | Couchbase Connector | 0 – before 1.3.2 |
| Delphix Continuous data | Cassandra Connector | 0 – before 2025.1.0 |
| Delphix Continuous data | YugabyteDB Connector | 0 – before 2025.1.1 |
| Delphix Continuous data | MSSQL on Linux Connector | 0 – before 2025.1.0 |
| Delphix Continuous data | Oracle Backup Ingestion Connector | 0 – before 4.2.1 |
Weakness: CWE-78 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N