P4 Search CVE-2026-103508

Requires an authenticated user holding administrative privileges on the connected P4 Server (PR:H) who can supply a crafted P4 Search logging configuration; the AT:P attack requirement reflects that the attacker must control the logging-configuration content and target a traversal path the service account can write to. Limiting factors: only P4 Search versions 2026.4.2 and earlier are affected (fixed in 2026.4.3), exploitation is impossible without P4 Server administrative access, and the outcome is bounded by the privileges of the P4 Search service account. No end-user interaction is required (UI:N).

This is a genuine but conditional integrity/availability risk rather than a mass-exploitation priority. The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:H) shows network reachability but gates exploitation behind PR:H - the attacker must already hold administrative privileges on the connected P4 Server - and AT:P indicates an additional attack requirement (control over the logging configuration). No EPSS score, CISA KEV listing, or public POC is present in the supplied data, so there is no public exploit identified at time of analysis. The high CVSS (7.3) is driven by the code-execution outcome (VI:H/VA:H) as the P4 Search service account, not by ease of access. Signals are consistent - no conflict between CVSS and the description, both agreeing that a privileged, authenticated actor is required. Note the CPE and the 'P4 Helix Core' tag reference Helix Core, whereas the description unambiguously scopes the flaw to P4 Search (formerly Helix Search); this product-labeling discrepancy should be corrected (see data_quality_flags). Overall: a post-authentication privilege-abuse/path-traversal issue meaningful to Perforce shops but low urgency for broad fleets, appropriate for routine patching to 2026.4.3.

An administrator (or an attacker who has compromised an admin account) on the connected P4 Server submits a crafted P4 Search logging configuration whose path escapes the intended logging directory. Because the service writes or deletes files along that attacker-controlled path, the adversary overwrites a file executed by the P4 Search service, achieving code execution as the P4 Search service account. No public exploit code is identified at time of analysis, and the attack requires both administrative privileges and the ability to influence the logging configuration.