What’s Vulnerable › Vulnerabilities
CVE-2026-103509: Credential Disclosure in P4 Search Configuration API
- Severity: high (CVSS 8.5 v4.0)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.2% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-10-15 · updated 2026-10-16
- Weakness: CWE-1220
Description
P4 Search (formerly Helix Search) returns stored credentials in cleartext through its configuration API to users with administrative privileges on the connected P4 Server, allowing privilege escalation. This affects 2026.4.2 and earlier and is fixed in 2026.4.3.
Affected products
- Perforce P4 (Helix Core): through 2026.4.3
References
Get alerted when CVE-2026-103509 or the next vulnerability affects your stack