Perforce CVE-2026-14254

Perforce Delphix Continuous Data contains a race condition in authentication failure tracking that allows attackers to bypass the account lockout mechanism and conduct unlimited password attacks against targeted user accounts. This silently neutralizes a critical control organizations rely on to prevent credential stuffing, directly exposing privileged access to data management systems and the sensitive data they protect.

Within 24 hours: Inventory all Delphix instances in production and identify highest-risk accounts (administrative, service accounts); enable detailed authentication logging and configure alerts for repeated failed login attempts per account. Within 7 days: Deploy network-level rate limiting on Delphix authentication endpoints, enforce multi-factor authentication for all access where supported, and restrict administrative access to hardened bastion hosts and private IP ranges; notify data governance and platform teams of the risk. Within 30 days: Monitor Perforce security advisories for patch availability, conduct a formal risk assessment of accounts that could be targeted, and develop a remediation timeline-prioritize patching as soon as a vendor fix is released or plan migration to alternative data management platforms if extended delay occurs.

No vendor-released patch identified at time of analysis. Interim mitigations: Implement network rate limiting on authentication endpoints to slow brute-force attempts; enforce multi-factor authentication for Delphix administrative and sensitive access; deploy real-time monitoring and alerting on failed login patterns per account; apply organization-wide password policies requiring minimum 16 characters and complexity; restrict Delphix network access to known IP ranges and hardened jump hosts; implement read-only access restrictions for non-privileged users until patch is available.