Perforce
Monthly
Remote code execution in the report-processing code of Puppet Server (shipped in Puppet Enterprise) lets a client holding any CA-signed agent certificate run arbitrary commands as the Puppet Server service user by sending a PUT request whose report body contains a crafted rich-data type. The authentication bar is real but conditional: in a properly configured CA the attacker must already control a legitimately enrolled agent, whereas a CA that autosigns certificate requests without strong verification lets an unauthenticated network attacker obtain a valid certificate on demand and effectively erase that requirement. The multi-source decision is act_now, no public exploit code was identified in the available data, and a fixed version is not stated in the supplied sources - the Puppet security page is the reference to monitor.
Incorrect authorization in trapperkeeper-authorization, used by Puppet Server and Puppet Enterprise, lets a client holding a CA-issued certificate whose name extends or shortens an authorized hostname be treated as that host. This enables node impersonation and, in Puppet Enterprise, access to certificate-authority administration and remote command execution on managed nodes. Exploitation requires a colliding certificate issued through CA approval or autosign, and no public exploit code was identified in the provided sources at time of analysis.
Cleartext credential disclosure in P4 Search (formerly Helix Search) 2026.4.2 and earlier allows an authenticated administrator on the connected P4 Server to retrieve stored credentials through the product's configuration API, enabling privilege escalation beyond the administrator's intended scope. The defect is rooted in insufficient granularity of access control (CWE-1220): the API exposes secret material that administrators should not be able to read back, and the resulting credential exposure has cross-boundary confidentiality, integrity, and availability consequences per the assessed scope change (S:C). Exploitation is privilege-gated by the PR:H authentication requirement in the CVSS vector, so this is not reachable by anonymous or unprivileged users, and no public exploit code or confirmed active exploitation has been identified at time of analysis. A vendor patch is available in P4 Search 2026.4.3.
Authenticated administrators on a connected P4 Server can exploit a relative path traversal (CWE-23) in P4 Search 2026.4.2 and earlier by supplying a crafted logging configuration, causing files to be written or deleted outside the intended logging directory and potentially achieving code execution as the P4 Search service account. Perforce resolved the issue in P4 Search 2026.4.3; no public exploit code has been identified at time of analysis (no CISA KEV listing), and because a P4 Server administrative account is a hard prerequisite, this is a genuine but conditional integrity/availability risk rather than a mass-exploitation priority.
Unauthorized SCIM API access in Perforce Helix Authentication Service (HAS) versions 2022.1 through 2025.2 arises from a shipped default bearer token that the installer and configuration script fail to rotate, enabling remote, unauthenticated attackers who know the token to perform user and group provisioning operations. Chaining this with CVE-2026-61834 in the scim-patch dependency allows server-side prototype pollution and, under Node.js 24/Express with specific gadget chains, remote code execution. The underlying defect is removed in HAS 2026.1; no public exploit code has been identified at time of analysis.
Perforce P4 Search before 2026.4.2 fails open when its service authentication token is blank, so an unauthenticated remote attacker with network access to the service can obtain the highest application privilege, potentially compromising both P4 Search and the P4 Server it is connected to (CWE-636). The vendor rates this CVSS 4.0 9.5; our independent assessment is CVSS 3.1 AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H because the attack requires the victim deployment to be running in the blank-token configuration (Attack Requirements: Present), meaning deployments that set a non-blank service authentication token are not exploitable. No public exploit code has been identified at time of analysis, and there is no confirmed actively exploited (CISA KEV) status; the issue is nonetheless a genuine high-priority authentication bypass rather than a CVSS-inflated paper risk, and impact extends to the connected P4 Server.
Arbitrary file write in Perforce P4 Search versions prior to 2026.4.2 allows an attacker who already holds a valid P4 Search service authentication token to dictate the file path used by the logging configuration interface and thereby write files anywhere on the host, which can escalate to code execution under the P4 Search service account. The flaw is a credentialed, privileged operation rather than an unauthenticated internet-facing attack: exploitation requires the service token, network reachability of the configuration interface, and a version older than the fixed 2026.4.2 release. No public exploit code and no confirmed active exploitation were identified at time of analysis; the practical risk is concentrated in environments where the service token is weakly protected or the interface is broadly exposed.
Unauthenticated remote code execution is possible in Perforce P4 Search container images prior to 2026.4.2 due to an exposed Java Debug Wire Protocol (JDWP) interface. An attacker with network access to the JDWP port can execute arbitrary code as the P4 Search service account, potentially compromising the connected P4 Server. No public exploit code has been identified at time of analysis, but the issue is rated critical (CVSS 9.5 in CVSS 4.0, assessed as CVSS 3.1 with scope change) and requires the debug interface to be reachable (attack prerequisite AT:P), making it a genuine high-priority issue rather than a high-CVSS-but-low-risk artifact.
XML external entity (XXE) injection in Perforce's Akana API Platform allows remote unauthenticated attackers to abuse improperly restricted external references during XML-to-JSON processing. Affected builds are 2026.1, 2025.1.1, and every release before 2024.1.6 (including older unsupported versions); Perforce has shipped a security patch in the latest supported releases. No public exploit identified at time of analysis, but the CVSS 4.0 score of 9.2 and the unauthenticated network vector make this a high-priority patch for any exposed Akana gateway.
Remote code execution in Perforce Akana API Platform allows unauthenticated attackers to run arbitrary code on the Policy Manager console host. A path normalization discrepancy between the authentication filter and the servlet dispatcher lets a crafted request slip past authentication and reach an endpoint that evaluates attacker-supplied script without sandboxing. Rated CVSS 4.0 10.0; no public exploit identified at time of analysis, but the no-auth/no-interaction profile makes this a top-priority patch.
Brute-force protection bypass in Perforce Delphix Continuous Data lets remote attackers defeat the account lockout mechanism by firing concurrent authentication requests that race the failed-login counter, allowing unlimited password guessing against a targeted account. The flaw is a time-of-check/time-of-use race (CWE-307) rather than a direct code-execution bug, and no public exploit identified at time of analysis. It matters because it silently neutralizes a control administrators rely on to stop credential-stuffing and password-spraying.
Code injection vulnerability in the Command-Line Client of P4 Server (Helix Core) prior to version 2025.2 Patch 2 allows remote attackers to execute arbitrary code. The vulnerability requires user interaction but no authentication, with a CVSS 7.7 score indicating high impact across confidentiality, integrity, and availability. Perforce has released a patch in version 2025.2 Patch 2.
Helix Core Server (P4D) before 2026.1 ships with insecure default configurations allowing remote unauthenticated attackers to create arbitrary user accounts, enumerate users, authenticate without passwords, and access repository contents via the built-in 'remote' user. EPSS score of 0.06% (19th percentile) suggests low observed exploitation attempts despite the high CVSS 8.8 score and SSVC classification as automatable with partial impact. No active exploitation confirmed (not in CISA KEV). Perforce reports this as vendor-disclosed with secure-by-default enforced in version 2026.1.
Arbitrary file write in Perforce P4 Search versions prior to 2026.4.2 allows an attacker who already holds super-user or service-token privileges to write files with attacker-controlled content into the P4 Search installation directory via the extension installation feature, which fails to validate supplied file names (CWE-73). The vulnerability is authenticated and gated by a PR:H requirement, so exploitation is not possible for unauthenticated or low-privileged users; the realistic risk is confined to malicious insiders, abused service tokens, or an attacker who has already compromised a privileged account. The vendor rates it CVSS 4.0 base 5.1 (VC:N/VI:L/VA:L), and no public exploit code or confirmed active exploitation (CISA KEV) has been identified at time of analysis.
Host-based authentication controls in Perforce P4 Search prior to 2026.4.2 can be bypassed because the service trusts a client-supplied address when validating certain authentication requests, allowing a holder of a stolen P4 Server ticket to defeat ticket host-binding and trusted-address restrictions and obtain access to P4 Search as that ticket's owner. The flaw is authenticated in nature (CVSS:4.0 vector shows PR:L and the independent assessment concurs), so it does not grant access on its own - the attacker must already possess a valid but stolen ticket, and the bypass is only meaningful in deployments that rely on host-binding or trusted-address controls; where those controls are absent, the stolen ticket already grants the same access. Severity is moderate (CVSS 5.3, independent CVSS:3.1 base 5.3) with low confidentiality and integrity impact confined to the single compromised ticket's permissions; no public exploit code has been identified at time of analysis and there is no confirmed active exploitation (not in CISA KEV), so this is best treated as a medium-severity defense-in-depth gap rather than a standalone critical issue.
Cleartext storage of sensitive parameters in Puppet's resource_api module (versions 1.5.0-1.9.1 and 2.0.0) causes passwords and other credential values to persist unmasked in the Puppet agent's local transaction state cache. The sensitive flag - intended to prevent exactly this exposure - is silently dropped during resource_api parameter processing, meaning any resource type built on this API and declaring sensitive parameters leaks those values to the cache filesystem. No public exploit exists and this is not listed in CISA KEV, but the confidentiality impact is high for environments where Puppet manages secrets such as database passwords or API tokens.
In versions of Akana API Platform prior to 2024.1.0 overly verbose errors can be found in SAML integrations. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
In versions of Akana API Platform prior to 2024.1.0, SAML tokens can be replayed. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
In versions of Akana API Platform prior to 2024.1.0 a flaw resulting in XML External Entity (XXE) was discovered. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
In Helix Sync versions prior to 2024.1, a local command injection was identified. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
In Helix Core versions prior to 2023.2, an unauthenticated remote Denial of Service (DoS) via the buffer was identified. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An arbitrary code execution which results in privilege escalation was discovered in Helix Core versions prior to 2023.2. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
In Helix Core versions prior to 2023.2, an unauthenticated remote Denial of Service (DoS) via the commit function was identified. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
In Helix Core versions prior to 2023.2, an unauthenticated remote Denial of Service (DoS) via the shutdown function was identified. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The XML Import functionality of the Administration console in Perforce Helix ALM 2020.3.1 Build 22 accepts XML input data that is parsed by insecurely configured software components, leading to XXE. Rated medium severity (CVSS 4.9), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
An exposure of sensitive information vulnerability exists in Jenkins Perforce Plugin version 1.3.36 and older in PerforcePasswordEncryptor.java that allows attackers with insufficient permission to. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
An exposure of sensitive information vulnerability exists in Jenkins Perforce Plugin version 1.3.36 and older in PerforcePasswordEncryptor.java that allows attackers with local file system access to. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Rogue Wave JViews before 8.8 patch 21 and 8.9 before patch 1 allows remote attackers to execute arbitrary Java code that exists in the classpath, such as test code or administration code. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Remote code execution in the report-processing code of Puppet Server (shipped in Puppet Enterprise) lets a client holding any CA-signed agent certificate run arbitrary commands as the Puppet Server service user by sending a PUT request whose report body contains a crafted rich-data type. The authentication bar is real but conditional: in a properly configured CA the attacker must already control a legitimately enrolled agent, whereas a CA that autosigns certificate requests without strong verification lets an unauthenticated network attacker obtain a valid certificate on demand and effectively erase that requirement. The multi-source decision is act_now, no public exploit code was identified in the available data, and a fixed version is not stated in the supplied sources - the Puppet security page is the reference to monitor.
Incorrect authorization in trapperkeeper-authorization, used by Puppet Server and Puppet Enterprise, lets a client holding a CA-issued certificate whose name extends or shortens an authorized hostname be treated as that host. This enables node impersonation and, in Puppet Enterprise, access to certificate-authority administration and remote command execution on managed nodes. Exploitation requires a colliding certificate issued through CA approval or autosign, and no public exploit code was identified in the provided sources at time of analysis.
Cleartext credential disclosure in P4 Search (formerly Helix Search) 2026.4.2 and earlier allows an authenticated administrator on the connected P4 Server to retrieve stored credentials through the product's configuration API, enabling privilege escalation beyond the administrator's intended scope. The defect is rooted in insufficient granularity of access control (CWE-1220): the API exposes secret material that administrators should not be able to read back, and the resulting credential exposure has cross-boundary confidentiality, integrity, and availability consequences per the assessed scope change (S:C). Exploitation is privilege-gated by the PR:H authentication requirement in the CVSS vector, so this is not reachable by anonymous or unprivileged users, and no public exploit code or confirmed active exploitation has been identified at time of analysis. A vendor patch is available in P4 Search 2026.4.3.
Authenticated administrators on a connected P4 Server can exploit a relative path traversal (CWE-23) in P4 Search 2026.4.2 and earlier by supplying a crafted logging configuration, causing files to be written or deleted outside the intended logging directory and potentially achieving code execution as the P4 Search service account. Perforce resolved the issue in P4 Search 2026.4.3; no public exploit code has been identified at time of analysis (no CISA KEV listing), and because a P4 Server administrative account is a hard prerequisite, this is a genuine but conditional integrity/availability risk rather than a mass-exploitation priority.
Unauthorized SCIM API access in Perforce Helix Authentication Service (HAS) versions 2022.1 through 2025.2 arises from a shipped default bearer token that the installer and configuration script fail to rotate, enabling remote, unauthenticated attackers who know the token to perform user and group provisioning operations. Chaining this with CVE-2026-61834 in the scim-patch dependency allows server-side prototype pollution and, under Node.js 24/Express with specific gadget chains, remote code execution. The underlying defect is removed in HAS 2026.1; no public exploit code has been identified at time of analysis.
Perforce P4 Search before 2026.4.2 fails open when its service authentication token is blank, so an unauthenticated remote attacker with network access to the service can obtain the highest application privilege, potentially compromising both P4 Search and the P4 Server it is connected to (CWE-636). The vendor rates this CVSS 4.0 9.5; our independent assessment is CVSS 3.1 AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H because the attack requires the victim deployment to be running in the blank-token configuration (Attack Requirements: Present), meaning deployments that set a non-blank service authentication token are not exploitable. No public exploit code has been identified at time of analysis, and there is no confirmed actively exploited (CISA KEV) status; the issue is nonetheless a genuine high-priority authentication bypass rather than a CVSS-inflated paper risk, and impact extends to the connected P4 Server.
Arbitrary file write in Perforce P4 Search versions prior to 2026.4.2 allows an attacker who already holds a valid P4 Search service authentication token to dictate the file path used by the logging configuration interface and thereby write files anywhere on the host, which can escalate to code execution under the P4 Search service account. The flaw is a credentialed, privileged operation rather than an unauthenticated internet-facing attack: exploitation requires the service token, network reachability of the configuration interface, and a version older than the fixed 2026.4.2 release. No public exploit code and no confirmed active exploitation were identified at time of analysis; the practical risk is concentrated in environments where the service token is weakly protected or the interface is broadly exposed.
Unauthenticated remote code execution is possible in Perforce P4 Search container images prior to 2026.4.2 due to an exposed Java Debug Wire Protocol (JDWP) interface. An attacker with network access to the JDWP port can execute arbitrary code as the P4 Search service account, potentially compromising the connected P4 Server. No public exploit code has been identified at time of analysis, but the issue is rated critical (CVSS 9.5 in CVSS 4.0, assessed as CVSS 3.1 with scope change) and requires the debug interface to be reachable (attack prerequisite AT:P), making it a genuine high-priority issue rather than a high-CVSS-but-low-risk artifact.
XML external entity (XXE) injection in Perforce's Akana API Platform allows remote unauthenticated attackers to abuse improperly restricted external references during XML-to-JSON processing. Affected builds are 2026.1, 2025.1.1, and every release before 2024.1.6 (including older unsupported versions); Perforce has shipped a security patch in the latest supported releases. No public exploit identified at time of analysis, but the CVSS 4.0 score of 9.2 and the unauthenticated network vector make this a high-priority patch for any exposed Akana gateway.
Remote code execution in Perforce Akana API Platform allows unauthenticated attackers to run arbitrary code on the Policy Manager console host. A path normalization discrepancy between the authentication filter and the servlet dispatcher lets a crafted request slip past authentication and reach an endpoint that evaluates attacker-supplied script without sandboxing. Rated CVSS 4.0 10.0; no public exploit identified at time of analysis, but the no-auth/no-interaction profile makes this a top-priority patch.
Brute-force protection bypass in Perforce Delphix Continuous Data lets remote attackers defeat the account lockout mechanism by firing concurrent authentication requests that race the failed-login counter, allowing unlimited password guessing against a targeted account. The flaw is a time-of-check/time-of-use race (CWE-307) rather than a direct code-execution bug, and no public exploit identified at time of analysis. It matters because it silently neutralizes a control administrators rely on to stop credential-stuffing and password-spraying.
Code injection vulnerability in the Command-Line Client of P4 Server (Helix Core) prior to version 2025.2 Patch 2 allows remote attackers to execute arbitrary code. The vulnerability requires user interaction but no authentication, with a CVSS 7.7 score indicating high impact across confidentiality, integrity, and availability. Perforce has released a patch in version 2025.2 Patch 2.
Helix Core Server (P4D) before 2026.1 ships with insecure default configurations allowing remote unauthenticated attackers to create arbitrary user accounts, enumerate users, authenticate without passwords, and access repository contents via the built-in 'remote' user. EPSS score of 0.06% (19th percentile) suggests low observed exploitation attempts despite the high CVSS 8.8 score and SSVC classification as automatable with partial impact. No active exploitation confirmed (not in CISA KEV). Perforce reports this as vendor-disclosed with secure-by-default enforced in version 2026.1.
Arbitrary file write in Perforce P4 Search versions prior to 2026.4.2 allows an attacker who already holds super-user or service-token privileges to write files with attacker-controlled content into the P4 Search installation directory via the extension installation feature, which fails to validate supplied file names (CWE-73). The vulnerability is authenticated and gated by a PR:H requirement, so exploitation is not possible for unauthenticated or low-privileged users; the realistic risk is confined to malicious insiders, abused service tokens, or an attacker who has already compromised a privileged account. The vendor rates it CVSS 4.0 base 5.1 (VC:N/VI:L/VA:L), and no public exploit code or confirmed active exploitation (CISA KEV) has been identified at time of analysis.
Host-based authentication controls in Perforce P4 Search prior to 2026.4.2 can be bypassed because the service trusts a client-supplied address when validating certain authentication requests, allowing a holder of a stolen P4 Server ticket to defeat ticket host-binding and trusted-address restrictions and obtain access to P4 Search as that ticket's owner. The flaw is authenticated in nature (CVSS:4.0 vector shows PR:L and the independent assessment concurs), so it does not grant access on its own - the attacker must already possess a valid but stolen ticket, and the bypass is only meaningful in deployments that rely on host-binding or trusted-address controls; where those controls are absent, the stolen ticket already grants the same access. Severity is moderate (CVSS 5.3, independent CVSS:3.1 base 5.3) with low confidentiality and integrity impact confined to the single compromised ticket's permissions; no public exploit code has been identified at time of analysis and there is no confirmed active exploitation (not in CISA KEV), so this is best treated as a medium-severity defense-in-depth gap rather than a standalone critical issue.
Cleartext storage of sensitive parameters in Puppet's resource_api module (versions 1.5.0-1.9.1 and 2.0.0) causes passwords and other credential values to persist unmasked in the Puppet agent's local transaction state cache. The sensitive flag - intended to prevent exactly this exposure - is silently dropped during resource_api parameter processing, meaning any resource type built on this API and declaring sensitive parameters leaks those values to the cache filesystem. No public exploit exists and this is not listed in CISA KEV, but the confidentiality impact is high for environments where Puppet manages secrets such as database passwords or API tokens.
In versions of Akana API Platform prior to 2024.1.0 overly verbose errors can be found in SAML integrations. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
In versions of Akana API Platform prior to 2024.1.0, SAML tokens can be replayed. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
In versions of Akana API Platform prior to 2024.1.0 a flaw resulting in XML External Entity (XXE) was discovered. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
In Helix Sync versions prior to 2024.1, a local command injection was identified. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
In Helix Core versions prior to 2023.2, an unauthenticated remote Denial of Service (DoS) via the buffer was identified. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An arbitrary code execution which results in privilege escalation was discovered in Helix Core versions prior to 2023.2. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
In Helix Core versions prior to 2023.2, an unauthenticated remote Denial of Service (DoS) via the commit function was identified. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
In Helix Core versions prior to 2023.2, an unauthenticated remote Denial of Service (DoS) via the shutdown function was identified. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The XML Import functionality of the Administration console in Perforce Helix ALM 2020.3.1 Build 22 accepts XML input data that is parsed by insecurely configured software components, leading to XXE. Rated medium severity (CVSS 4.9), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
An exposure of sensitive information vulnerability exists in Jenkins Perforce Plugin version 1.3.36 and older in PerforcePasswordEncryptor.java that allows attackers with insufficient permission to. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
An exposure of sensitive information vulnerability exists in Jenkins Perforce Plugin version 1.3.36 and older in PerforcePasswordEncryptor.java that allows attackers with local file system access to. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Rogue Wave JViews before 8.8 patch 21 and 8.9 before patch 1 allows remote attackers to execute arbitrary Java code that exists in the classpath, such as test code or administration code. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.