Perforce vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2026-103509 P4 Search (formerly Helix Search) returns stored credentials in cleartext through its configuration API to users with administrative privileges on the connectedHigh 8.5 · Oct 15, 2026
• CVE-2026-103508 P4 Search (formerly Helix Search) allows an authenticated user holding administrative privileges on the connected P4 Server to supply a crafted logging configurHigh 7.3 · Oct 15, 2026
• CVE-2026-109758 Perforce Helix Authentication Service (HAS) deployments that retain the shipped default SCIM bearer token are vulnerable to unauthorized access when the SCIM enCritical 9.3 · Oct 13, 2026
• CVE-2026-103510 P4 Search prior to 2026.4.2 does not fail securely when its service authentication token is blank.Critical 9.5 · Oct 5, 2026
• CVE-2026-103507 Perforce P4 Search prior to 2026.4.2 does not restrict file paths written through its logging configuration interface.High 7.5 · Oct 5, 2026
• CVE-2026-100102 Perforce P4 Search container images prior to 2026.4.2 enable an unauthenticated Java debug interface.Critical 9.5 · Oct 5, 2026
• CVE-2026-85979 Affected versions of Puppet Enterprise contain a command injection vulnerability.High 8.6 · Sep 11, 2026
• CVE-2026-89212 A flaw resulting in XML external entity (XXE) was found in Akana API Platform in which references were improperly restricted during XML-to-JSON processing.Critical 9.2 · Sep 11, 2026
• CVE-2026-85978 An unauthenticated remote code execution vulnerability exists in the Policy Manager console of Akana API Platform.Critical 10 · Sep 9, 2026
• CVE-2026-14254 A race condition in the account lockout mechanism in Delphix Continous Data allowed the lockout threshold to be bypassed through concurrent authentication requeHigh 8.3 · Jul 16, 2026
• CVE-2026-6902 A Remote Code Execution vulnerability in P4 (Helix Core) Server's Command-Line Client, prior to the 2025.2 Patch 2, has been fixed to address potential securityHigh 7.7 · May 18, 2026
• CVE-2026-6043 P4 Server versions prior to 2026.1 are configured with insecure default settings that, when exposed to untrusted networks, allow unauthenticated attackers to crHigh 8.8 · Apr 24, 2026
• CVE-2025-5459 A user with specific node group editing permissions and a specially crafted class parameter could be used to execute commands as root on the primary host.High 8.6 · Jun 26, 2025
• CVE-2025-3113 A valid, authenticated user with sufficient privileges and who is aware of Continuous Compliance’s internal database configurations can leverage the applicationCritical 9 · Apr 17, 2025
• CVE-2025-2903 An attacker with knowledge of creating user accounts during VM deployment on Google Cloud Platform (GCP) using the OS Login feature, can login via SSH gaining cHigh 8.5 · Apr 17, 2025
• CVE-2015-8965 Rogue Wave JViews before 8.8 patch 21 and 8.9 before patch 1 allows remote attackers to execute arbitrary Java code that exists in the classpath, such as test cCritical 9.8 · Apr 6, 2017
• CVE-2010-0934 The triggers functionality in Perforce Server 2008.1 allows remote authenticated users with super privileges to execute arbitrary operating-system commands by uHigh 7.1 · Mar 5, 2010
• CVE-2008-1338 The Perforce service (p4s.exe) in Perforce Server 2007.3/143793 and earlier allows remote attackers to cause a denial of service (daemon crash) via a server-DifHigh 7.8 · Mar 14, 2008
• CVE-2007-6349 P4Webs.exe in Perforce P4Web 2006.2 and earlier, when running on Windows, allows remote attackers to cause a denial of service (CPU consumption) via an HTTP reqHigh 7.8 · Dec 20, 2007
• CVE-2007-0100 The Perforce client does not restrict the set of files that it overwrites upon receiving a request from the server, which allows remote attackers to overwrite aHigh 10 · Jan 8, 2007