by Kastro
Paper/Archive/CVE-2026-100102

CVE-2026-100102

Perforce P4 (Helix Core) — RCE via exposed JDWP debug agent in P4Search

EPSS 0.4%CVSS 9.5
critical.is priorityof 100
34
CVSS 9.5 (CNA)9.5 / 10 × 3028.5Not in CISA KEV+300.0EPSS percentile 29.4.294 × 205.9No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Perforce P4 Search container images prior to 2026.4.2 enable an unauthenticated Java debug interface. An attacker with network access to this interface can execute arbitrary code as the P4 Search service account, potentially leading to compromise of the connected P4 Server.

Affected

ProductAffectedFixed inSource
P4 (Helix Core)≤ 2026.4.12026.4.2CNA

Scores by source

Perforce (CNA)9.5CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

refportal.perforce.com/s/cve/a91Qi000003FE7NIAW/rce-via-exposed-jdwp-debug-agent-in-p4search