EUVD-2026-92291
GHSA-crr7-cpqh-vjm5
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable default token needs no auth or interaction (PR:N/UI:N/AC:L); compromise extends from P4 Search to the connected P4 Server, so S:C with full C/I/A impact.
Primary rating from Vendor (Perforce).
CVSS VectorVendor: Perforce
Lifecycle Timeline
2DescriptionCVE.org
Perforce P4 Search container images prior to 2026.4.2 reset the service authentication token to a publicly documented default value. An unauthenticated attacker with network access can obtain the highest application privilege, potentially leading to arbitrary code execution and compromise of the connected P4 Server.
AnalysisAI
Unauthenticated network attackers can gain the highest application privileges on Perforce P4 Search container images prior to 2026.4.2 because the service authentication token is reset to a publicly documented default value (CWE-1392). Successful exploitation can lead to arbitrary code execution and compromise of any connected P4 Server, but full impact requires that the P4 Search container be network-reachable and that a P4 Server be connected to it. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The vulnerable component is the Perforce P4 Search container image at any version prior to 2026.4.2, which on affected builds resets the service authentication token to a publicly documented default value (CWE-1392). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine top-priority vulnerability, not a high-CVSS-but-low-real-risk case. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade Perforce P4 Search container images to version 2026.4.2 or later; this is the vendor-released patch and removes the default-token reset behavior. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Perforce P4 Search container images and identify any running versions prior to 2026.4.2, immediately restrict network access to these containers to trusted management networks only, block all internet exposure, and change the service authentication token from any known default if the configuration permits; within 7 days, isolate P4 Search containers from connected P4 Servers where search functionality is not essential, decommission unused instances, enforce least-privilege network policies, and monitor logs for default-token authentication or anomalous access; within 30 days, engage Perforce support for interim guidance, plan migration to 2026.4.2 or later when a vendor-released patch is available, and implement configuration baselines and scanning to prevent default token reset on all P4 Search deployments. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in P4 Helix Core
View allUnauthenticated remote code execution is possible in Perforce P4 Search container images prior to 2026.4.2 due to an exp
Perforce P4 Search before 2026.4.2 fails open when its service authentication token is blank, so an unauthenticated remo
Code injection vulnerability in the Command-Line Client of P4 Server (Helix Core) prior to version 2025.2 Patch 2 allows
Arbitrary file write in Perforce P4 Search versions prior to 2026.4.2 allows an attacker who already holds a valid P4 Se
Host-based authentication controls in Perforce P4 Search prior to 2026.4.2 can be bypassed because the service trusts a
Arbitrary file write in Perforce P4 Search versions prior to 2026.4.2 allows an attacker who already holds super-user or
Same weakness CWE-1392 – Use of Default Credentials
View allShare
External POC / Exploit Code
Leaving vuln.today