CVE-2026-14254 PUBLISHED

Improper Restriction of Excessive Authentication Attempts in Delphix Continuous Data

Assigner: Perforce
Reserved: 30.06.2026 Published: 16.07.2026 Updated: 16.07.2026

A race condition in the account lockout mechanism in Delphix Continous Data allowed the lockout threshold to be bypassed through concurrent authentication requests. Parallel login attempts were processed before the failed-login counter and lockout status were updated, defeating brute-force protections and enabling continued password guessing against a targeted account.

Metrics

CVSS 4.0

CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N
CVSS Score: 8.3

Exploitability Metrics		Vulnerable System Impact Metrics		Subsequent System Impact Metrics
Attack Vector	Network	Confidentiality	Low	Confidentiality	None
Attack Complexity	Low	Integrity	Low	Integrity	None
Attack Requirements	Present	Availability	High	Availability	None
Privileges Required	None
User Interaction	None

CVSS 4.0

Product Status

Vendor	Perforce
Product	Delphix Continuous Data
Versions	Default: affected Version 2026.4.0.0 is unaffected

Solutions

Upgrade to Delphix Continuous Data version 2026.4.0.0

Credits

Security Team at Truist Financial Corporation reporter

References

https://portal.perforce.com/s/cve/a91Qi0000036VKLIA2/improper-restriction-of-excessive-authentication-attempts-in-delphix-cd

Problem Types

CWE-307 Improper restriction of excessive authentication attempts CWE