P4 Server CVE-2026-6902

Successful exploitation requires a legitimate user to interact with malicious input through the P4 command-line client. The vulnerability does not require authentication from the attacker's perspective but does require user interaction to trigger the code injection. The CVSS vector indicates specific attack requirements must be present (AT:P), though the exact conditions are not detailed in the available information.

The CVSS 7.7 score reflects a network-based attack (AV:N) with low complexity (AC:L) that requires no authentication (PR:N) but does require user interaction (UI:P). The CVSS vector indicates high impact to confidentiality, integrity, and availability (VC:H/VI:H/VA:H) with lower secondary system impacts. The 'AT:P' (Attack Requirements: Present) suggests specific conditions must be met for exploitation. No EPSS score or KEV status is provided, and no public exploit code has been identified, suggesting this may not be widely exploited despite the high CVSS score. The requirement for user interaction significantly reduces the automated exploitation risk.

An attacker crafts malicious input that, when processed by a legitimate user through the P4 command-line client, injects and executes arbitrary code. This could occur when a user interacts with attacker-controlled repository content or processes malicious command-line arguments, leading to full system compromise with the privileges of the user running the client.