CVE-2026-8654: Delphix Continuous data IBM Db2 Connector, инжекция

Описание

Оригинално описание

Improper input validation in Delphix Continuous Data connectors allows an authenticated user to execute arbitrary operating system commands on the staging or target host.

Засегнати продукти

• Delphix Continuous data IBM Db2 Connector: преди 2025.2
• Delphix Continuous data MangoDB Connector: преди 2025.2.1
• Delphix Continuous data PostgreSQL Connector: преди 2025.1.0
• Delphix Continuous data MySQL Connector: преди 2025.1.0
• Delphix Continuous data Oracle EBS Connector: преди 2025.2.0
• Delphix Continuous data SAP HANA Connector: преди 2026.2.0
• Delphix Continuous data CockroachDB Connector: преди 2025.2.0
• Delphix Continuous data Couchbase Connector: преди 1.3.2
• Delphix Continuous data Cassandra Connector: преди 2025.1.0
• Delphix Continuous data YugabyteDB Connector: преди 2025.1.1
• Delphix Continuous data MSSQL on Linux Connector: преди 2025.1.0
• Delphix Continuous data Oracle Backup Ingestion Connector: преди 4.2.1

Вид слабост

• CWE-78 Инжектиране на команди към операционната система

История

Първоизточници

• https://www.cve.org/CVERecord?id=CVE-2026-8654
• https://nvd.nist.gov/vuln/detail/CVE-2026-8654
• https://portal.perforce.com/s/cve/a91Qi000002z78HIAQ/authenticated-os-command-injection-in-delphix-continuous-data-connectors