This vulnerability arises from a race condition in the account lockout mechanism of Delphix Continuous Data by Perforce. Due to concurrent authentication requests being processed before the system updates the failed-login counter and lockout status, attackers can bypass the intended lockout threshold. This improper restriction of excessive authentication attempts (CWE-307) enables an adversary to perform continued password guessing attacks against targeted accounts, potentially compromising account security. The CVSS 4.0 base score is 8.3, reflecting high severity with network attack vector, low attack complexity, partial attack traceability, and high impact on availability.

The vulnerability allows attackers to circumvent account lockout protections designed to prevent brute-force password guessing. This can lead to unauthorized access if attackers successfully guess credentials. The flaw impacts the confidentiality and integrity of user accounts and the availability of the authentication mechanism by enabling repeated login attempts beyond intended limits.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround has been documented at this time. Organizations using Delphix Continuous Data should monitor Perforce advisories for updates and apply patches promptly once available. Until then, consider additional protective controls such as multi-factor authentication to reduce risk.