P4 Search CVE-2026-103509

Exploitation requires the attacker to already hold administrative privileges on the P4 Server connected to P4 Search; using that access they call the P4 Search configuration API, which discloses stored credentials in cleartext (CWE-1220). The limiting factor is the PR:H authentication requirement - this is not exploitable by anonymous or unprivileged users, so the realistic threat is a malicious or compromised administrator leveraging over-broad API disclosure to recover credentials and escalate beyond their intended scope. No special non-default configuration or user interaction is required; the disclosure occurs through the normal configuration API on affected versions 2026.4.2 and earlier.

This is a credible but privilege-gated issue rather than a mass-exploitation emergency. The vendor-supplied CVSS 4.0 vector (CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H, 8.5 High) shows a network-reachable, low-complexity attack with NO user interaction, but PR:H - the attacker must already hold administrative privileges on the connected P4 Server. The high score is driven by the subsequent-system impact (SC:H/SI:H/SA:H): leaked cleartext credentials enable privilege escalation beyond the admin's original scope, consistent with CWE-1220 (insufficient granularity of access control). No EPSS score, CISA KEV listing, or public POC is present in the supplied data, so exploitation probability signals are entirely absent - no public exploit identified at time of analysis. Net judgment: real and worth prioritizing for Perforce administrators because exploitation is trivial once admin access exists and yields credential theft/lateral escalation, but it is NOT a broad unauthenticated internet threat. The PR:H gate means the realistic threat model is a malicious or compromised lower-trust administrator escalating, not an anonymous remote attacker. Note a source discrepancy to verify with the vendor: the CPE and the 'P4 Helix Core' tag reference Helix Core, while the description and reference URL clearly identify the affected product as P4 Search (formerly Helix Search).

An administrator on a connected P4 Server - or an attacker who has compromised such an admin account - queries the P4 Search configuration API, which returns stored credentials in cleartext. Those recovered credentials are then reused to access accounts or systems beyond the attacker's original authorization, achieving privilege escalation. No public exploit code is identified in the available data; exploitation requires only a low-complexity authenticated API call.