A race condition vulnerability in Perforce Delphix Continuous Data allows for the circumvention of account lockout protections, posing a significant risk to system authentication security.

This vulnerability involves a race condition in the account lockout mechanism (CWE-307), which allows an attacker to bypass security policies regarding failed authentication attempts. The vulnerability is exploitable by unauthenticated attackers, although it requires precise timing of concurrent requests to succeed.

Successful exploitation of this flaw allows an attacker to repeatedly attempt authentication without triggering lockout thresholds, significantly increasing the probability of a successful brute-force attack. Given the CVSS score of 8.3, this represents a high-severity risk that could lead to unauthorized system access and subsequent data compromise.

Immediate Action: Upgrade to Delphix Continuous Data version 2026.4.0.0 as specified by the vendor.

Proactive Monitoring: Monitor authentication logs for patterns of high-frequency, concurrent login requests from single or multiple IP addresses that do not result in expected account lockouts.

Compensating Controls: Implement stricter rate limiting at the network or application gateway level to mitigate the impact of concurrent authentication attempts until the patch can be applied.

Public Exploit Available: No (exploit_available: false)

The high severity of this vulnerability necessitates immediate attention to prevent unauthorized access via brute-force techniques. Organizations should prioritize updating to version 2026.4.0.0 to remediate the underlying race condition and restore the integrity of the account lockout mechanism.