Which versions of Delphix Continuous Data are affected by CVE-2026-14254?

Perforce Delphix Continuous Data contains a race condition in authentication failure tracking that allows attackers to bypass the account lockout mechanism and conduct unlimited password attacks…

How to fix or mitigate CVE-2026-14254?

Within 24 hours: Inventory all Delphix instances in production and identify highest-risk accounts (administrative, service accounts); enable detailed authentication logging and configure alerts for repeated failed login attempts per account. Within 7 days: Deploy network-level rate limiting on Delphix authentication endpoints, enforce multi-factor authentication for all access where supported, and restrict administrative access to hardened bastion hosts and private IP ranges; notify data governance and platform teams of the risk. Within 30 days: Monitor Perforce security advisories for patch availability, conduct a formal risk assessment of accounts that could be targeted, and develop a remediation timeline-prioritize patching as soon as a vendor fix is released or plan migration to alternative data management platforms if extended delay occurs.

Delphix Continuous Data CVE-2026-14254

Q: What is the CVSS score of CVE-2026-14254?

CVE-2026-14254 has a CVSS 4.0 base score of 8.3 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X.

EUVD-2026-44930 HIGH

Improper Restriction of Excessive Authentication Attempts (CWE-307)

2026-07-16 Perforce

GHSA-wpgf-w64m-w6wv

Authentication Bypass Delphix Continuous Data

8.3

CVSS 4.0 · Vendor: Perforce

Severity by source

Vendor (Perforce) PRIMARY

8.3 HIGH

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (Perforce) · only source for this CVE.

CVSS VectorVendor: Perforce

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 16, 2026 - 15:01 vuln.today

CVE Published

Jul 16, 2026 - 14:12 cve.org

HIGH 8.3

DescriptionCVE.org

A race condition in the account lockout mechanism in Delphix Continous Data allowed the lockout threshold to be bypassed through concurrent authentication requests. Parallel login attempts were processed before the failed-login counter and lockout status were updated, defeating brute-force protections and enabling continued password guessing against a targeted account.

AnalysisAI

Brute-force protection bypass in Perforce Delphix Continuous Data lets remote attackers defeat the account lockout mechanism by firing concurrent authentication requests that race the failed-login counter, allowing unlimited password guessing against a targeted account. The flaw is a time-of-check/time-of-use race (CWE-307) rather than a direct code-execution bug, and no public exploit identified at time of analysis. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Recommended ActionAI

Within 24 hours: Inventory all Delphix instances in production and identify highest-risk accounts (administrative, service accounts); enable detailed authentication logging and configure alerts for repeated failed login attempts per account. …

Threat intelligence, references, and detailed analysis are available after sign-in.