Helix Core Server EUVD-2026-25415

Exploitation requires the P4 server to be network-accessible from the attacker's location, either internet-exposed or reachable via compromised internal network segments. The server must be running a pre-2026.1 version with default out-of-box configuration, specifically: (1) 'dm.user.noautocreate' configurable not set to restrictive value, allowing unauthenticated user creation, (2) built-in 'remote' user account present with depot access permissions in the protections table and no password requirement enforced, and (3) no external authentication integration (LDAP/AD/SSO) overriding default authentication behavior. Exploitation is NOT limited by user interaction (UI:N), privilege requirements (PR:N), or attack complexity (AC:L). Organizations that have manually hardened configurables, implemented network segmentation limiting server exposure to trusted clients only, or integrated with external authentication systems are not vulnerable despite running affected versions. The default-shipped configuration state is the primary enabling condition.

Real-world risk is moderate despite high CVSS score. The 8.8 CVSS reflects worst-case network exposure with unauthenticated access to high-value repositories. However, EPSS exploitation probability of 0.06% (19th percentile) indicates this is not being widely exploited in the wild, likely because production Helix Core deployments are typically behind corporate firewalls or VPNs rather than internet-exposed. SSVC framework confirms exploitation=none (no public exploit observed), automatable=yes (trivial to exploit via API calls), technical_impact=partial (source code disclosure but limited system compromise). CISA has not added this to KEV, supporting the EPSS assessment of low active exploitation. The primary risk is to organizations that expose P4 servers directly to untrusted networks (internet-facing instances, partner extranet access, or compromised internal networks). For air-gapped or properly firewalled deployments, risk is significantly lower. Key risk driver is the attractiveness of source code repositories to APT actors and ransomware groups, making this a latent high-impact vulnerability if exposure conditions are met. Organizations should prioritize upgrade if their deployment model includes any untrusted network access or if defense-in-depth network controls are weak.

An attacker scans for internet-exposed Helix Core servers on port 1666 using network reconnaissance tools. Upon discovering an instance running a pre-2026.1 version, they connect using the p4 CLI or API and invoke 'p4 user -f newadmin' to create a privileged user account without authentication. They enumerate existing users with 'p4 users' to identify legitimate accounts, then authenticate as the built-in 'remote' user (which has no password requirement in default configuration) using 'p4 login'. With depot access established, they sync the entire source code repository via 'p4 sync //...' to exfiltrate proprietary code, trade secrets, and embedded credentials. The attack requires only network access and basic knowledge of Perforce CLI commands, with no exploit code needed beyond normal client usage.