Improper input validation in Delphix Continuous Data connectors allows an authenticated user to execute arbitrary operating system commands

Summary

Improper input validation in Delphix Continuous Data connectors allows an authenticated user to execute arbitrary operating system commands on the staging or target host.

Timeline

1. May 15, 2026, 5:59 AM UTCCVE published
2. May 15, 2026, 11:09 AM UTCCISA SSVC assessment

   Exploitation: none · Automatable: no · Technical impact: total

3. May 15, 2026, 11:09 AM UTCRecord last updated

Affected versions

• Delphix Continuous data IBM Db2 Connector

  fixed in 2025.2

• Delphix Continuous data MangoDB Connector

  fixed in 2025.2.1

• Delphix Continuous data PostgreSQL Connector

  fixed in 2025.1.0

• Delphix Continuous data MySQL Connector

  fixed in 2025.1.0

• Delphix Continuous data Oracle EBS Connector

  fixed in 2025.2.0

• Delphix Continuous data SAP HANA Connector

  fixed in 2026.2.0

• Delphix Continuous data CockroachDB Connector

  fixed in 2025.2.0

• Delphix Continuous data Couchbase Connector

  fixed in 1.3.2

• Delphix Continuous data Cassandra Connector

  fixed in 2025.1.0

• Delphix Continuous data YugabyteDB Connector

  fixed in 2025.1.1

• Delphix Continuous data MSSQL on Linux Connector

  fixed in 2025.1.0

• Delphix Continuous data Oracle Backup Ingestion Connector

  fixed in 4.2.1

References 1